Add Custom Match Criteria to a Predefined Data Pattern

1. Log in to Strata Cloud Manager.
2. Select ConfigurationData Loss PreventionDetection MethodsData Patterns.
3. Locate the predefined regex data pattern.
4. Expand Actions and select Clone.

5. (Optional) Modify the Data Pattern Name and Description.
6. (Optional) Add any additional Proximity Keywords.

   Proximity keywords are not case-sensitive. You can enter additional proximity keywords to increase the probability that Enterprise DLP accurately detects a regular expression match. Proximity keywords affect the Enterprise DLP confidence level, which reflects how confident the service is when it detects matched traffic. Enterprise DLP determines the confidence level by inspecting the distance between regular expressions and proximity keywords.

   Data patterns that don't include any proximity keywords to identify a match always have both Low and High confidence level detections in a DLP incident.
7. (Optional) Enter the Proximity Distance (between 1 and 1,000) to specify the maximum character distance between sensitive data and proximity keywords required to trigger a detection.

   The default proximity distance is 200.

   For large files or traffic containing sensitive data where related proximity keywords might be separated by longer text blocks, you can increase the proximity distance to ensure proper detection. Conversely, for files or traffic where you need tighter control to reduce false positives, you can specify a smaller proximity distance to ensure only closely associated keywords trigger a match.

   The minimum proximity keyword distance must be the character length of the longest proximity keyword plus one character. This includes spaces within the proximity keyword value.

   For example, consider the list of proximity keywords in the custom data pattern below. The longest proximity keyword is driver's license, which is 16 characters. In this case, the minimum proximity keyword distance is 17.

8. Add the custom match criteria to specify data to include or exclude from inspection and verdict rendering.

   Up to 50,000 characters are supported in each field. You specify one, some, or all custom data match criteria.

   Follow these rules when you enter and separate values in these fields:

   • Separate multiple values in a single field with a comma (,).
   • A space after a comma is trimmed, so a value entered with or without a space after the comma is treated as the same value.
   • Values that contain spaces don't require quotation marks; enter them as-is.
   • The semicolon (;) is the delimiter for the weighted regular expression field, not for the custom match criteria fields.

   Add your match criteria to any of the following fields:

   • Include Matches Starting With: Inclusive match criteria that inspect for and trigger Enterprise DLP enforcement on only data matches starting with one or more of the added criteria.
     This field is an AND operator.
   • Include Matches End With: Inclusive match criteria that inspect for and trigger Enterprise DLP enforcement on only data matches ending with one or more of the added criteria.
     This field is an AND operator.
   • Exclude Matches Starting With: Exclusion match criteria that exclude data matches starting with one or more of the added criteria from Enterprise DLP inspection and enforcement.
     This field is an OR operator.
   • Exclude Matches Ending With: Exclusion match criteria that exclude data matches ending with one or more of the added criteria from Enterprise DLP inspection and enforcement.
     This field is an OR operator.

9. Click Save.
10. Create a data profile on Strata Cloud Manager.