Issues with Symantec Data Loss Prevention endpoint IDM exact matching
search cancel

Issues with Symantec Data Loss Prevention endpoint IDM exact matching

book

Article ID: 162779

calendar_today

Updated On:

Products

Data Loss Prevention Endpoint Prevent

Issue/Introduction

There are several issues that limit or prevent Indexed Document Matching (IDM) exact file and exact file contents matching on endpoints. These issues affect Symantec Data Loss Prevention 14 and earlier. This article describes these issues, and, where possible, provides workarounds.

Resolution

 

ISSUE DESCRIPTION WORKAROUND
Different versions of the detection engine. If the detection engine version used to index a file is different than the version used to detect a file (as might happen if different versions of Data Loss Prevention are involved), the file might not match. You must use the same version of Data Loss Prevention for both the DLP Agent and the detection server.
Metadata not detected correctly. The Endpoint Server extracts metadata differently than the DLP Agent. Consequently, you must turn off metadata detection for both the Server and the Agent. See the Workaround column for details.

The following Endpoint Server Advanced Server Settings must be set to off:

ContentExtraction.EnableMetaData

ContentExtraction.MarkupAsText

The following Advanced Agent Settings must be set to off:

Detection.ENABLE_METADATA.str

Detection.MARKUP_AS_TEXT.str

Detection.TRACKED_CHANGES.str

 

 
Files larger than 30 MB. Exact matching will not work correctly for files larger than 30 MB unless the Endpoint Server and DLP Agent settings are set as detailed in the Workaround column.

The value for the Advanced Server Setting:

 DDM.MaxBinMatchSize

must equal the value for the Advanced Agent Setting:

 Detection.MAX_IDM_FILE_SIZE.int.

The default value for both is 30000000.
Different file type for indexed and detected file. If the type of file indexed (for example, .pdf or .doc) is different than the type of file that is detected, there may be no match.  
Text files with different encoding than the operating system. Text files with an encodng different than the default encoding of the OS are not matched.  
Files with the same text content but different graphical content. Files with the same text content but different graphical content (for example, two files similar in text but one file contains "picture1.jpg" and the other contains "picture2.jpg") might be reported as the same (false positive).  

 

Powered by Wolken Software