Create customized expressions if none of the predefined expressions meet the
company's requirements.
Expressions are a powerful string-matching tool. Become comfortable with expression
syntax before
creating expressions. Poorly written expressions can dramatically impact performance.
When creating expressions:
-
Refer to the predefined expressions for guidance on how to define valid expressions.
For example,
when creating an expression that includes a date, refer to the expressions prefixed
with "Date".
-
Note that
Data Loss Prevention follows the expression formats defined in Perl Compatible Regular
Expressions
(PCRE). For more information on PCRE, visit the following website:
-
Start with simple expressions. Modify the expressions if
they are causing false alarms or fine tune them to improve detections.
Administrators can choose from several criteria when creating expressions. An expression
must
satisfy the chosen criteria before Data Loss Prevention subjects it to a DLP policy.
For details
about the different criteria options, see
Criteria for Customized Expressions.
