Advanced DLP configurations

The following topic provides information on advanced DLP configurations.

DLP data type

This configuration includes pre-defined data types to match for keyword, regex, hex, credit card, and social security number (SSN). Custom data types can be added.

config dlp data-type
    edit "keyword"
        set pattern "built-in"
    next
    edit "regex"
        set pattern "built-in"
    next
    edit "hex"
        set pattern "built-in"
    next
    edit "mip-label"
        set pattern "^[[:xdigit:]]{8}-[[:xdigit:]]{4}-[[:xdigit:]]{4}-[[:xdigit:]]{4}-[[:xdigit:]]{12}$"
        set transform "built-in"
    next
    edit "credit-card"
        set pattern "\\b([2-6]{1}\\d{3})[- ]?(\\d{4})[- ]?(\\d{2})[- ]?(\\d{2})[- ]?(\\d{2,4})\\b"
        set verify "built-in"
        set look-back 20
        set transform "\\b\\1[- ]?\\2[- ]?\\3[- ]?\\4[- ]?\\5\\b"
    next
    edit "ssn-us"
        set pattern "\\b(\\d{3})-(\\d{2})-(\\d{4})\\b"
        set verify "(?<!-)\\b(?!666|000|9\\d{2})\\d{3}-(?!00)\\d{2}-(?!0{4})\\d{4}\\b(?!-)"
        set look-back 12
        set transform "\\b\\1-\\2-\\3\\b"
    next
end

To add a custom DLP data type:

config dlp data-type
    edit <name>
        set pattern <string>
        set verify <string>
        set transform <string>
    next
end

pattern <string>	Enter a regular expression pattern string without a look around.
verify <string>	Enter a regular expression pattern string used to verify the data type.
transform <string>	Enter the template to transform user input to a pattern using the capture group from pattern.

To use "?" in a regex pattern, see CLI basics. This method only supports direct console connection and SSH. It does not support the CLI console in the GUI.

DLP file pattern

A DLP file pattern can block, allow, log, or quarantine a file based on the specified file type in the file filter list (see Supported file types).

To configure a DLP file pattern:

config dlp filepattern
    edit <id>
        set name <name>
        config entries
            edit <name>
                set filter-type {type | pattern}
                set file-type <file_type>
            next
        end
    next
end

Evaluation by Logical relationship

Evaluation by Logical relationship is a powerful tool used to combine multiple dictionary entries to define an accurate DLP sensor using logical expression.

Syntax example:

1. set eval "dict(1) == 2"

   Match DLP sensor only when dictionary one match count is two.

2. set eval "(dict(1) + dict(2)) == 3"

   Match DLP sensor only when dictionary one and dictionary two combined match count is three.

3. set eval "(dict(1) == 2) && (dict(2) == 1)"

   Match DLP sensor only when dictionary one match count is equal to two and dictionary two match count is equal to one.

4. set eval "(dict(1) == 2) || (dict(2) == 1)"

   Match DLP sensor only when dictionary one match count is equal to two or dictionary two match count is equal to one.

5. set eval "dict(1) > dict(2)"

   Match DLP sensor only when dictionary one match count is greater than dictionary two match count.

See Example 4: Block HTTPS upload traffic that includes Visa or Mastercard information using evaluation via logical expression.