Data Loss Prevention

 View Only

 Form Recognition File & OCR

silvi marcelia adinata's profile image
silvi marcelia adinata posted Jan 19, 2024 03:08 AM

Hi for the form recognition I've tried using many of **** fillable e-form (acroform format) made into form recognition profile, some of it detects, meanwhile some of it dont 
what could be the problem? I honestly still don't get what differentiate it since I adhere to the form recognition gallery archives preparation in Symantec DLP guide.

For the 2nd try, I tried to make my own form, turn them to PDF, edit it in acrobat to fillable form, made it into form recognition profile, adding it to policy, and tested it, resulting in no matches as well (I tested them by entering the fillable form with some input, and send them outside organization in monitored dlp agent, it doesn't get detected as incident)

For the 3rd try, I've tried using the **** form with no fillable input, made it into form recognition profile, adding it to policy and tested it, resulting in no matches again (no incident)

For the 4th try, I've tried using **** form from the testing dlp files (the PIF Symplified Healthcare hospital) and of course it gets detected even when I just put it in as a profile without the fillable format. Tested it again by putting the fillable format as a profile, it gets detected as well. 

Then, what is wrong with the form recognition, is it actually hard to implement? 

Below I also attach screenshot of fillable form profile that i made into profile, make it into policy and the test forms filled with input that didn't get recognized by Form Recognition Symantec DLP (it might be blurry for the screenshot, but the form is digital so it is not blurry at all. It has good resolution and doesn't break when zoomed in)

FORM WITH INPUT, NOT RECOGNIZED AS INCIDENT EVEN WHEN IT IS SENT OVER

FORM PROFILE THAT I PUT IN FORM RECOGNITION PROFILE, TOTAL OF 2 PDF FILES EACH CONSISTS SINGLE-PAGE, PUT INTO ZIP

Meanwhile for the OCR.

I've tried making policy keyword detection 'XYZZY' for OCR text. I made png from paint 800x400 size in white background, with text 'XXYYZ' all over the page. I tested by sending the png to ftp and it detected as incident.

I tried recreating the same problem, keyword detection policy 'testing dlp' using another word for OCR text detection. I made png from paint 800x400 size in white background, with text 'testing dlp' all over the page. I tested by sending the png to ftp and it doesn't get detected as incident. Tried again with another keyword rule that is included in active policy, result: doesn't get detected as incident as well.

Really appreciate if someone's willing to help, since this is part of project