Data Loss Prevention

Hello, I want to create a policy that detect the word "Confidencial"in the metadata of a word document.

 

I attach two print,

First the print with information in the metadata document

 

Second Enable the ContentExtractionEnableMetaData

Hello, It's not possible to differentiate where the detection is going to be made (advanced properties / Metadata vs document body), so you can create a normal policy to detect 'Confidential' as keyword match (DCM). Ps. Do not forget to activate the metadata at endpoint server level (advanced settings) besides the agent config setting. Regards,

Ok I have a keyword policy and activate te metadata an the endpoint server but the policy doesnt work

Confirm that the agent config change was applied to the correct agent group. You will need also to recycle / restart the endpoint server.

Yes i do that and the agent config change was applied

 

The agent you are testing already received the last updates from endpoint server? If you type Confidential in the document body an incident is generated then? I am running out of ideas.. Normally the steps I described above 'd be enough.

yes if i write confidencial in the body an incident is generated 

See https://support.symantec.com/en_US/article.TECH218860.html .  I found it useful.  Use the filter command to check if Tags is retrieved.