Definition

Indexed Document Matching (IDM) is a Symantec DLP detection technique that fingerprints unstructured documents - patent filings, board decks, M&A drafts, source code repositories - and detects when those documents (or substantial portions of them) appear in outbound content. Sensitivity is configurable: detect 25%, 50%, 75%, or near-100% overlap with an indexed document. IDM is what makes Symantec DLP suitable for IP and trade-secret protection: regex (DCM) cannot detect that someone is leaking a strategy deck, but IDM can. Common corpora: patent portfolios, board document libraries, strategy decks, customer contracts, source code. Refresh: monthly for active repositories, quarterly for stable IP corpus. See our EDM/IDM deep-dive.

Symantec products that implement this

  • Symantec Data Loss Prevention - Discover, monitor, and protect sensitive data across endpoints, network, storage, cloud, and email - the most comprehensive enterprise DLP platform on the market.

Related terms

  • DLP (Data Loss Prevention) - Security capability that discovers, monitors, and protects sensitive data across endpoints, networks, storage, cloud, and email.
  • EDM (Exact Data Matching) - DLP detection technique that fingerprints structured data sources (databases, CSV exports) and detects exact matches in outbound content.
  • DCM (Described Content Matching) - DLP detection technique using regex patterns, dictionaries, and keywords - fast but high false-positive rate.
  • VML (Vector Machine Learning) - DLP detection technique using trained ML classifiers for categories where rules and fingerprints don't scale.

Deep-dives on IDM