waf dlp sensor

Use this command to configure a DLP (Data Loss Prevention) sensor to define which dictionaries to check. You can match any dictionary or all dictionaries. It can also count the number of dictionary matches to trigger the sensor.

Syntax

config waf dlp sensor

edit <name>

set match-type {any | all}

config entries

edit <entry_index>

set dictionary <dlp-dictionary_name>

set count <integer>

set status {enable | disable}

next

end

next

end

Variable	Description	Default
<name>	Enter a unique name that can be referenced by other parts of the configuration. The maximum length is 63 characters.	No default
match-type {any | all}	Select Match type: all: Data meeting the criteria specified by all dictionary entries will be identified as a match. any: Data meeting the criteria specified by any one of the dictionary entries will be identified as a match.	any
config entries
<entry_index>	Enter the index number of the individual entry in the table. The valid range is 1–9,223,372,036,854,775,807.	No default
dictionary <dlp-dictionary_name>	Specify a previously configured DLP dictionary. See waf dlp dictionary.	No default
count <integer>	Enter the occurrence threshold for the dictionary match. The sensor will be triggered when the dictionary match reaches the specified number of times. The valid range is 1–255. For instance, if the dictionary applies to credit card numbers and the count is set to 4, the sensor will be triggered when credit card number occurs four times in the HTTP request or response. Please note that if the count is set to 2 or larger values, make sure the Repeat switch is on in the DLP Dictionary settings.	1
status {enable | disable}	Switch on to enable the dictionary.	enable

Example

config waf dlp sensor
  edit "Sensor1"
    set match-type any
    config  entries
      edit 1
        set dictionary fg-can-natl_id-sin-dict
      next
    end
  next
end

Related topics:

• waf dlp policy

• waf dlp rule

• waf dlp dictionary

• waf dlp exception