Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Email Security Quick-links: ESA Product Support | SMA Product Support | Email Submission and Tracking Portal | Cisco SecurityHub
Current General Deployment (GD) Releases:
ESA: 11.0.0-264 WSA: 10.5.1-296 SMA: 11.0.0-115 Email Plug-in (Reporting): 1.0.1-048 Email Plug-in (Encryption): 1.0.0-036

New Member

using RSA DLP to search for word in header not in body of document

User wants to search for confidential Word documents leaving the system using outbound email RSA DLP.  Using the supplied Confidential Documents policy you can search for strings like Confidential but it finds that word in the body, headers, footers or metadata (properties) of the Word document.  This leads to too many false positives.  They want to be able to look for the word Confidential that occurs just in the header (or footer) of the document, and not trigger the policy if the word only occurs in the body.  I have experimented with looking for the xml tag for headers (<w:pStyle w:val="Header"/> in the .xml saved version of Word documents and have come up with a workaround but it only works for .xml files not .doc or .docx.  I am sure this must have come up before but I can't find anything online.  Anyone out there with experience of this?  Thanks, Dave