Strata Cloud Manager

1. Log in to Strata Cloud Manager.
2. Select ConfigurationData Loss PreventionDetection MethodsData Patterns.
3. Click Add Data Patterns and select Custom.

   You can also create a new custom data pattern by copying an existing custom data pattern. To copy a custom data pattern, select the data pattern name to view the data pattern details and copy (

   ). You can then configure the custom data pattern you copied as needed.
4. Enter a descriptive Data Pattern Name.

   If updating an existing data pattern, Enterprise DLP supports changing the data pattern name only if the data pattern isn't currently in use in a data profile or a Data Security (SaaS API) data asset policy rule. You must remove the data pattern from the data profile data asset policy before you change the name. Enterprise DLP prevents you from changing the name if the data pattern is currently in use.

   Enterprise DLP updates the data pattern name for all DLP incidents with the new archived data pattern name amendment after you archive a data pattern. It takes about 10 minutes for the new data pattern name to reflect in the Incident Manager for existing and new incidents.
5. (Optional) Enter a Description for the data pattern.
6. Select the type of Regular Expression.

   You can choose Basic or Weighted data patterns. Use the Weighted data pattern to create a basic or weighted regular expression. With weighted regular expressions, you assign each text entry a score and when the score threshold is exceeded, such as when enough expressions from a pattern match an asset, Enterprise DLP indicates that the asset is a match for the pattern.

   Use the query builder in the Regular Expressions field to add either regular (Basic) or Weighted expressions.
7. (Optional) Enter one or more Proximity Keywords.

   Proximity keywords aren't case-sensitive. You can enter one or more proximity keywords to increase the probability Enterprise DLP accurately detects a regular expression match. Proximity keywords impact the Enterprise DLP confidence level, which reflects how confident Enterprise DLP is when detecting matched traffic. Enterprise DLP determines confidence level by inspecting the distance of regular expressions to proximity keywords.

   Data patterns that don't include any proximity keywords to identify a match always have both Low and High confidence level detections in a DLP incident.

   Custom regex data patterns can't detect Microsoft sensitivity labels stored in LabelInfo.xml within co-authored Microsoft Office documents. To detect these labels, use AIP Tags file property data patterns instead.
8. (Optional) Enter the Proximity Distance (between 1 and 1,000) to specify the maximum character distance between sensitive data and proximity keywords required to trigger a detection.

   The default proximity distance is 200.

   For large files or traffic containing sensitive data where related proximity keywords might be separated by longer text blocks, you can increase the proximity distance to ensure proper detection. Conversely, for files or traffic where you need tighter control to reduce false positives, you can specify a smaller proximity distance to ensure only closely associated keywords trigger a match.

   The minimum proximity keyword distance must be the character length of the longest proximity keyword plus one character. This includes spaces within the proximity keyword value.

   For example, consider the list of proximity keywords in the custom data pattern below. The longest proximity keyword is phone number which is 12 characters. In this case, the minimum proximity keyword distance is 13.

9. Save and Test the data pattern.
10. Review the Regex Analyzer results.

    If you're updating an existing data pattern, Enterprise DLP initiates the Regex Analyzer only if you add a new regex or edit an existing one. Enterprise DLP doesn't re-analyze unchanged regex.

    When you save a data pattern that contains regular expressions, Enterprise DLP automatically runs the Regex Analyzer to evaluate each expression for performance issues and compatibility with the optimized scan engine.

    Enterprise DLP analyzes your regex for two things:

    • Regex Efficiency—Checks each expression for patterns that can cause catastrophic backtracking or excessive processing time.
    • Optimized Engine Compatibility—Determines whether each expression is compatible with the optimized Enterprise DLP scan engine for high-performance detection.

    After the analysis completes, Enterprise DLP provides a detailed analysis breakdown for each discrete regex you added to the data pattern.

    • Regex Summary List
      Lists all the discrete regex in the data pattern and provides an at-a-glance analysis summary:
      • Efficient—Expression executes within acceptable performance thresholds and doesn't require changes.
      • Timed Out—Expression contains patterns that cause excessive processing time, such as nested quantifiers, unbounded wildcards, or constructs prone to catastrophic backtracking.
      Common patterns that cause expensive regex scan performance:

      • Leading unbounded wildcards—.*test.* (use test instead)
      • Nested quantifiers—(a+)+$ (use a+$ instead)
      • Unbounded dot-star with anchored suffix—.*\d{3}-\d{2}-\d{4}.* (use \d{3}-\d{2}-\d{4} instead)
    • Regex Analysis Details
      Enterprise DLP provides you an analysis of your current regex as well as an optimized version of your original regex generated with AI. Enterprise DLP determines regex efficiency based on:
      • Scan Latency—Total time elapsed to detect sensitive data against the test file using the regex. Efficient expressions complete in under 10 seconds. Expensive expressions exceed the 10-second threshold and are interrupted.
      • Scan File Size—File size used to test regex efficiency. Always displays 200 KB.
      Alternatively, Enterprise DLP also recommends a predefined or custom advanced detection method you can use instead of regex detection. Advanced detection methods can offer additional logic to increase detection accuracy, reduce false positive detections, and reduce scan latency.
      While Enterprise DLP offers alternatives to your original regex, you're not required to select a recommended regex or advanced detection method to save the data pattern after regex analysis is complete.

    • Regex Intent
      An AI-generated summary of the intention of the regex detection. Review the Regex Intent to validate that your regex pattern detects the correct sensitive data.

    Save the data pattern.
11. Create a data profile on Strata Cloud Manager.