>
    Strata Copilot
    Create a Custom Data Pattern
    Focus
    Download PDF
    Focus
    1. Home
    2. Enterprise DLP
    3. Administration
    4. Configure Enterprise DLP
    5. Data Patterns
    6. Create a Custom Data Pattern
    Download PDF
    Enterprise DLP

    Create a Custom Data Pattern

    Table of Contents

    Create a Custom Data Pattern

    Create an Enterprise Data Loss Prevention (E-DLP) custom data pattern using regular expressions or file properties.
    Where Can I Use This?What Do I Need?
    • NGFW (Managed by Panorama or Strata Cloud Manager)
    • Prisma Access (Managed by Panorama or Strata Cloud Manager)
    • Prisma Browser
    • Enterprise Data Loss Prevention (E-DLP) license
      Review the Supported Platforms for details on the required license for each enforcement point.
    Or any of the following licenses that include the Enterprise DLP license
    • Prisma Access CASB license
    • Next-Generation CASB for Prisma Access and NGFW (CASB-X) license
    • Data Security license
    Create an Enterprise Data Loss Prevention (E-DLP) custom data pattern to specify the match criteria and identify sensitive information on your network using regular expressions (regex) and keywords. Enterprise DLP synchronizes all data patterns across your Panorama® management server and Strata Cloud Manager that are associated with your tenant. You can edit any custom data pattern, regardless of whether you create it on Panorama or Strata Cloud Manager.
    If you add multiple regular expressions to a single unweighted (Basic) data pattern, Enterprise DLP treats each regular expression as an OR condition. A match on any one regular expression is a match for the data pattern.
    In a weighted data pattern, Enterprise DLP adds the weight scores of the matching regular expressions, with negative weights reducing the total, and returns a match for the data pattern when the total exceeds the weight threshold.
    Custom regex data patterns can't detect Microsoft sensitivity labels stored in LabelInfo.xml within co-authored Microsoft Office documents, even when using the Metadata match scope in a data profile. To detect these labels, use an AIP Tags file property data pattern instead.

    Strata Cloud Manager

    Create an Enterprise Data Loss Prevention (E-DLP) custom regular expression (regex) data pattern on Strata Cloud Manager.
    1. Log in to Strata Cloud Manager.
    2. Select ConfigurationData Loss PreventionDetection MethodsData Patterns.
    3. Click Add Data Patterns and select Custom.
      You can also create a custom data pattern by copying an existing one. To copy a custom data pattern, select its name to view the details and copy (
      ). You can then configure the copy as needed.
    4. Enter a descriptive Data Pattern Name.
      If you update an existing data pattern, Enterprise DLP supports changing the name only if the data pattern isn't currently in use in a data profile or a Data Security (SaaS API) data asset policy rule. You must remove the data pattern from the data profile or data asset policy rule before you change the name.
      After you archive a data pattern, Enterprise DLP updates the data pattern name for all DLP incidents with the new archived data pattern name. It takes about 10 minutes for the new name to appear in the Incident Manager for existing and new incidents.
    5. (Optional) Enter a Description for the data pattern.
    6. Select the type of Regular Expression.
      You can choose Basic or Weighted data patterns. Use the Weighted data pattern to create a basic or weighted regular expression. With weighted regular expressions, you assign each text entry a score and when the score threshold is exceeded, such as when enough expressions from a pattern match an asset, Enterprise DLP indicates that the asset is a match for the pattern.
      Use the query builder in the Regular Expressions field to add Basic or Weighted expressions.
    7. (Optional) Enter one or more Proximity Keywords.
      Proximity keywords aren't case-sensitive and increase the probability that Enterprise DLP accurately detects a regular expression match. Proximity keywords impact the Enterprise DLP confidence level, which reflects the likelihood that matched traffic is accurately detected. Enterprise DLP determines the confidence level by inspecting the distance of regular expressions to proximity keywords.
      Data patterns that don't include proximity keywords to identify a match always have both Low and High confidence level detections in a DLP incident.
      Custom regex data patterns can't detect Microsoft sensitivity labels stored in LabelInfo.xml within co-authored Microsoft Office documents. To detect these labels, use AIP Tags file property data patterns instead.
    8. (Optional) Enter the Proximity Distance (between 1 and 1,000) to specify the maximum character distance between sensitive data and proximity keywords required to trigger a detection.
      The default proximity distance is 200.
      For large files or traffic containing sensitive data where related proximity keywords might be separated by longer text blocks, you can increase the proximity distance to ensure proper detection. Conversely, for files or traffic where you need tighter control to reduce false positives, you can specify a smaller proximity distance to ensure only closely associated keywords trigger a match.
      The minimum proximity distance must be the character length of the longest proximity keyword plus one character. Include spaces within the proximity keyword value in the character count.
      For example, consider the list of proximity keywords in the custom data pattern below. The longest proximity keyword is phone number, which is 12 characters. In this case, the minimum proximity distance is 13.
    9. Save and Test the data pattern.
    10. Review the Regex Analyzer results.
      If you update an existing data pattern, Enterprise DLP initiates the Regex Analyzer only if you add a new regex or edit an existing one. Enterprise DLP doesn't re-analyze unchanged regex.
      When you save a data pattern that contains regular expressions, Enterprise DLP automatically runs the Regex Analyzer to evaluate each expression for performance issues and compatibility with the optimized scan engine.
      Enterprise DLP analyzes your regex for the following:
      • Regex Efficiency—Checks each expression for patterns that can cause catastrophic backtracking or excessive processing time.
      • Optimized Engine Compatibility—Determines whether each expression is compatible with the optimized Enterprise DLP scan engine for high-performance detection.
      After the analysis completes, Enterprise DLP provides a detailed analysis breakdown for each discrete regex you added to the data pattern.
      • Regex Summary List
        Lists all the discrete regex in the data pattern and provides an at-a-glance analysis summary:
        • Efficient—Expression executes within acceptable performance thresholds and doesn't require changes.
        • Timed Out—Expression contains patterns that cause excessive processing time, such as nested quantifiers, unbounded wildcards, or constructs prone to catastrophic backtracking.
        Common patterns that cause expensive regex scan performance:
        • Leading unbounded wildcards—.*test.* (use test instead)
        • Nested quantifiers—(a+)+$ (use a+$ instead)
        • Unbounded dot-star with anchored suffix—.*\d{3}-\d{2}-\d{4}.* (use \d{3}-\d{2}-\d{4} instead)
      • Regex Analysis Details
        Enterprise DLP provides an analysis of your current regex and an AI-generated optimized version of your original regex. Enterprise DLP determines regex efficiency based on:
        • Scan Latency—Total time elapsed to detect sensitive data against the test file using the regex. Efficient expressions complete in under 10 seconds. Expensive expressions exceed the 10-second threshold, and Enterprise DLP interrupts them.
        • Scan File Size—File size used to test regex efficiency. Always displays 200 KB.
        Enterprise DLP also recommends a predefined or custom advanced detection method you can use instead of regex detection. Advanced detection methods can offer additional logic to increase detection accuracy, reduce false positive detections, and reduce scan latency.
        Enterprise DLP offers alternatives to your original regex, but you don't have to select a recommended regex or advanced detection method to save the data pattern after regex analysis completes.
      • Regex Intent
        An AI-generated summary of the intention of the regex detection. Review the Regex Intent to validate that your regex pattern detects the correct sensitive data.
      Click Save to save the data pattern.
    11. Create a data profile on Strata Cloud Manager.

    Panorama

    Create a data pattern to identify sensitive information on your network when using Enterprise Data Loss Prevention (E-DLP).
    1. Log in to the Panorama web interface.
    2. Select ObjectsDLPData Filtering Patterns.
      You don't need to select the device group associated with the managed devices that use Enterprise DLP. Enterprise DLP shares all data patterns across all device groups by default.
    3. Add a new data pattern.
    4. Specify a Name, Type, and criteria for the data pattern.
      Use any of the following data pattern types:
      • Regular Expression—Create regular expressions to use in the data pattern.
        You can choose Basic or Advanced data patterns. Use the Advanced data pattern to create a basic or weighted regular expression. With weighted regular expressions, you assign each text entry a score and when the score threshold is exceeded, such as when enough expressions from a pattern match an asset, Enterprise DLP indicates that the asset is a match for the pattern.
        Use the query builder in the Regular Expressions field to add Basic or weighted (Advanced) expressions.
        You can enter one or more Proximity Keywords to use with the data filtering pattern. Proximity keywords aren't case-sensitive and increase the probability that Enterprise DLP accurately detects a regular expression match. Proximity keywords impact the Enterprise DLP confidence level, which reflects the likelihood that matched traffic is accurately detected. Enterprise DLP determines the confidence level by inspecting the distance of regular expressions to proximity keywords.
        Data patterns that don't include proximity keywords to identify a match always have both Low and High confidence level detections in a DLP incident.
      • File Property—Add a file property pattern to match.
        If you use classification labels or embed tags in Microsoft Office and PDF documents for audit and tracking, you can create a file property data pattern that matches the metadata or attributes in the custom or extended properties of the file. Whether you use an automated classification mechanism, such as Titus, or require users to add a tag, you can specify a name-value pair to match on a custom or extended property embedded in the file.
        Enterprise DLP supports file property data patterns in Microsoft Office and PDF documents, including both the Object Linking and Embedding (OLE) format (.doc/.ppt) and the XML format (.docx/.pptx) of Microsoft Office.
        Add a Tag Name and Tag Value.
        A Tag Name and Tag Value are an associated pair that specifies the property to look for. For example, you can specify a Tag Name of Label and a Tag Value of Confidential. You can add as many file properties as you want. When you later reference the file property data pattern in a data filtering profile, Enterprise DLP uses a Boolean OR match in the match criteria.
        For files protected with Microsoft Azure Information Protection (AIP), you must enter the full AIP label Name that you want to take action on. The name can be either the MSIP_Label_<GUID>_Enabled label name or the Sensitivity label name.
    5. Click OK to save the data pattern.
    6. Commit and push the new configuration to your managed devices.
      The Commit and Push command isn't recommended for Enterprise DLP configuration changes. Using the Commit and Push command requires the additional and unnecessary overhead of manually selecting the impacted templates and managed devices in the Push Scope Selection.
      • Full configuration push from Panorama
        1. Select CommitCommit to Panorama, and then click Commit.
        2. Select CommitPush to Devices, and then click Edit Selections.
        3. Select Device Groups and Include Device and Network Templates.
        4. Click OK.
        5. Push your configuration changes to your managed devices that are using Enterprise DLP.
      • Partial configuration push from Panorama
        You must always include the temporary __dlp administrator when performing a partial configuration push. This is required to keep Panorama and Strata Cloud Manager in sync.
        For example, if the admin user is logged in and making changes, they must select both admin and __dlp in the partial commit and push.
        1. Select CommitCommit to Panorama.
        2. Select Commit Changes Made By and then click the current Panorama admin user to select additional admins to include in the partial commit.
          Select your logged-in admin user, the __dlp user, and any other admins whose changes you want to include. Click OK to continue.
        3. Commit.
        4. Select CommitPush to Devices.
        5. Select Push Changes Made By and then click the current Panorama admin user to select additional admins to include in the partial push.
          Select your logged-in admin user, the __dlp user, and any other admins whose changes you want to include. Click OK to continue.
        6. Select Device Groups and Include Device and Network Templates.
        7. Click OK.
        8. Push your configuration changes to your managed devices that are using Enterprise DLP.
    7. Create a data profile on Panorama or Strata Cloud Manager.

    © 2026 Palo Alto Networks, Inc. All rights reserved.