NDLP Fingerprinting Issue..

[pinaki.net]

Hi Friends,

I am facing issue regarding the fingerprinting in Mcafee Network DLP. I put some predefined templates (like .docx, .xls, .pdf etc) in a directory and scanning those for fingerprinting. Whenever I am sending mail(s) attaching the same template it is generating incident but when I add some content on those templates and sending it via mail with attachment it is not generating incident. Should it work in my scenario or not? Please help me to do this. I am using Mcafee NDLP v9.3.x.

Regards,

Pinaki.

[exbrit]

Moved to DLP for better support.

---

Peter

Moderator

[jhall2]

There is different levels of signature generation. What you are describing is low granularity. Low granularity only provides 1 signature for the document meaning any change will alter the signature. Try removing the registered documents and re-registering them with medium granularity.

More detailed info can be found in KB73218.

[palex]

Hi, Pinaki Bhadra!

Try to config you registration rule that:

Do Shedule with smallest time between the two scans (e.g., 1 in every 5 minutes or once every 1 hour). It depends on how often you add new files to the network storage or database.

Choose Signature Type High Granularity.

You can reed about Signature type in "Table 14-18 Definitions of signature types" at page 199 into "Product Guide Revision B McAfee Data Loss Prevention 9.3.2" (ndlp_932_pg_b_en-us.pdf).

Regards.