It is important to understand how the weight of an object
(SSN, CC#, pattern) is calculated in order to set the appropriate
threshold for a condition you are trying to filter. Each occurrence
multiplied by the weight value will be added together in order to
reach an action threshold (alert or block).
Example: Filter for Social Security Numbers Only
simplicity, if you only want to filter files with Social Security
Numbers (SSN) and you define a weight of 3 for SSN#, you would use
the following formula: each instance of a SSN x weight = threshold
increment. In this case, if a Word document has 10 social security
numbers you multiply that by the weight of 3, so 10 x 3 = 30. In
order to take action for a file that contains 10 social security
numbers you would set the threshold to 30. You may want to set an
alert at 30 and then block at 60. You may also want to set a weight
in the field SSN# (no dash) for Social Security Numbers that do
not contain dashes. If multiple settings are used, they will accumulate
to reach a given threshold.
Example: Filter for Social Security Numbers and
a Custom Pattern
In this example, we will filter on files
that contain Social Security Numbers and the custom pattern confidential.
In other words, if a file has Social Security Numbers in addition
to the word confidential and the combined instances of those items
hit the threshold, the file will trigger an alert or block, depending
on the action setting.
SSN# weight = 3
confidential weight = 20
The custom pattern is case sensitive.
the file contains 20 Social Security Numbers and a weight of 3 is
configured, that is 20 x 3 = 60. If the file also contains one instance
of the term confidential and a weight of 20 is configured, that
is 1 x 20 = 20 for a total of 80. If your threshold for block is
set to 80, this scenario would block the file. The alert or block
action will be triggered as soon as the threshold is hit.