Detecting tracked changes in Microsoft Word.
Relevant version: V9 and up
As of v9 there is a new setting in the Advanced Settings page on the Detection server called "ContentExtraction.TrackedChanges" that will allow you to perform matching against tracked changes in MS Word documents. There is a corresponding change for the endpoint on the Endpoint Advanced page, Detection.TRACKED_CHANGES.str. The two settings are independent and would need to be changed together. This will ensure that IDM policies for endpoints produce the same cracked content as other policies.Note: These features are turned off by default because, if enabled, pre-existing IDM policies could have a lower than expected match percentage.
NOTE: If turning on tracked changes for endpoint agents, be sure to also change the monitor setting on the Endpoint Server. This will ensure that IDM policies for endpoints produce the same cracked content as other policies.