4 Replies Latest reply on Sep 10, 2010 1:03 AM by psi

    Compliance on attachements

      Hello,

       

      I'm trying to check some words or substrings of the properties of PDF, MS Word.

       

      When those words are in the body of the dosument, the rule match but not with those words in properties !

       

      Somebody have an workaround, except using the DLP network solution ?

       

      Many Thank's

       

       

      Ce message a été modifié par: psi on 08.09.10 01:46:03 CDT
        • 1. Re: Compliance on attachements
          ijahnke

          The appliance is able to search through pdf's and word documents, but just to be sure I set up a test using a docx file and a pdf.

           

          My test consisted of

           

          1.) created dictionary called pdf_and_doc_test

          • Created two search terms: "test docx" and "test pdf"
          • Search option: Both
          • Search type: Word Boundary
          • Scan: Attachment

          2.) Created a rule for the dictionary in Content Analysis -> Manage Rules

          • Dictionary:  pdf_and_doc_test
          • Threshold: 20
          • Action: Quarantine
          • Action Value: 0
          • Quarantine Type: Content Filtering

          3.) Applied the rule in Content Analysis -> Apply Rules

          • Apply to: Global
          • Direction: Both (for testing purposes)
          • Enabled the dictionary "pdf_and_doc_test"

           

           

          In every case the behavior was as expected.

           

          Looking at how I set mine up, can you tell me what differences there are between our rules?

          • 2. Re: Compliance on attachements
            runcmd

            I believe PSI may be referring to the contents of document properties.  If I create a Word Document and place a dictionary catchphrase in the body of the document, IronMail will quarantine it.  If I place the same catchphrase in the document properties, IronMail does not quarantine it...  In Office 2007, I clicked on the Microsoft Office Button > Prepare > Properties and then entered the catchphrase in the "Comments" field.  I'm not sure if there are similar properties fields in PDFs.

            • 3. Re: Compliance on attachements
              ijahnke

              Ah I see.

               

              Unfortunately the properties of the word document would be stored as metadata and not as any kind of text - which means the ironmail would be unable to process the information.

              • 4. Re: Compliance on attachements

                Yes, according to RunCMD, I would like to match the properties of the document.

                 

                If the dictionnary words are in document properties, the rule didn't match ! Dictionnary rules seem to match only for words in the body of attachement.

                I've tested with Office 2003, Office 2007 and PDF 1.4 attachements.

                 

                If your are looking in PDF doc with a text editor, you will find properties of the document in clear text two times. More than, the second time that's an XML formated properties, like Office 2007 !

                 

                Thank's for your interest