McAfee Data Loss Prevention 9.2.2 Product Guide

Using McAfee DLP MonitorRules used by the capture engine 2Case insensitivityCase sensitivity is ignored by the search engine.For example, if a query is defined in ALL CAPS, the indexer retrieves and reports the matching contentwhether it is in uppercase or lowercase.Microsoft Office 2007 anomaliesThe indexer ignores certain Microsoft Office attributes because of the way those applications handlefonts, colors, macros, and page definition.• If two dictionary words are merged together, the merged word will not be found. For example,American and Recovery are two dictionary words. If they are merged into the wordAmericanRecovery, they will not be found.• If a word in a Microsoft Office document has different fonts and colors, the word will not be read asa whole and will not be found. For example, if all the letters in the word Recovery are of differentfonts and colors, it will not be found.• If a word continues across two different pages, it will not be found. For example, if the wordRecovery is spread across two pages (one page contains Rec and the second page contains overy),it will not be found.• Words in documents that use special Microsoft Office font features like WordArt, SmartArt, andwatermarks will not be found.• Words present in macros in Microsoft Office documents, and headers and footers in PowerPoint andExcel, will not be found.Negative searchesThe database cannot recognize queries that consist entirely of negative terms because a querycontaining only words that are not to be found is instructing the search engine not to search.For this reason, some scope of data within which the term will not be found must be defined.Proper name treatmentThe indexer treats proper names like keywords, so it is not necessary to capitalize them.Parts of speech excluded from captureThe capture engine excludes common parts of speech to prevent insignificant results from beingstored and retrieved.For example, the following parts of speech are ignored by the indexer:• a • else• and • while• this • with• thereforeUsers can deploy the Stop‐Word concept to define words the capture engine should ignore.McAfee Data Loss Prevention 9.2.2 Product Guide 39