Create customized expressions if none of the predefined expressions meet
the company's requirements.
Expressions are a powerful string-matching tool. Become comfortable with
expression syntax before creating expressions. Poorly written expressions can dramatically
impact
performance.
When creating expressions:
-
Refer to the predefined expressions for guidance on how to define
valid expressions. For example, when creating an expression that includes a date,
refer to the
expressions prefixed with "Date".
-
Note that Data Loss Prevention follows the expression formats defined
in Perl Compatible Regular Expressions (PCRE). For more information on PCRE, visit
the
following website:
 |
Note
You can define regular expressions used in customized DLP expressions the
same way as Content Filtering keyword lists. For details, see Advanced Regular Expressions.
|
-
Start with simple expressions. Modify the expressions if they are causing
false alarms or fine tune them to improve detections.
Administrators can choose from several criteria when creating expressions. An
expression must satisfy the chosen criteria before Data Loss Prevention subjects it
to a DLP
policy. For details about the different criteria options, see
Criteria for Customized Expressions.
