Data Loss Prevention

Hello,

 We made some test to detect content in office 2007 documents and office 2003 documents and it seems that some information that was detected using office 2003 are no more detected in office 2007 documents.

We are using DLP solution v11.1 and on our test platform we create some documents using word, excel, powerpoint then save it in 2003 and 2007 format. Then put both documents in same email and when this email is detected by monitor, in the corresponding incident it used to detect all elements in 2003 and miss some in 2007. Our policy is based on a "simple" keyword detection. Results seems better if we use IDM, but we need to also use some keyword to detect our sensitive data.

 Is there anyone who has the same experience (issue) or are we doing something wrong in our test ? One more point we are doing our test using eml file in drop folder.

Thanks in advance for your feedbacks.

If you can email each test document individually and DLP successfully detects all sensitive data but then you combine them all in one email and the problem happens then I don't think you're doing anything wrong with your testing.  It sounds more like DLP has a problem with the same content being processed in different formats consecutively.  You probably found a glitch in the product which means your better at testing than most. :)