Exact Data Matching (EDM)

Exact Data Matching (EDM) for Enterprise Data Loss Prevention (E-DLP) is an advanced detection tool to monitor and protect sensitive data from exfiltration. Use EDM to detect sensitive and personally identifiable information (PII) such as social security numbers, Medical Record Numbers, bank account numbers, and credit card numbers, in a structured data source such as databases, directory servers, or structured data files (CSV and TSV), with high accuracy.

To use EDM, Enterprise DLP relies on the encrypted hash of the sensitive data you upload to Enterprise DLP. Enterprise DLP indexes the encrypted hash of uploaded EDM data sets. To prevent the exfiltration of sensitive data, Enterprise DLP uses the indexed hash data set in the Security policy rule for matching outbound traffic.

By default, EDM data set values must be within 100 characters in order for Enterprise DLP to successfully detect sensitive data in inspected traffic. Contact Palo Alto Networks Customer Support to increase the maximum proximity characters to detect sensitive data.

For example, you upload an EDM data set that contains the following data:

In this case, Enterprise DLP detects sensitive data in inspected traffic if Smith and 22334455 are within 100 characters of each other.