Whole Word Keyword Detection

[MICHAEL KASHER]

I need to be able to detect “domain” but not “domain.com” using the DLP EndPoint agent with Outlook integration.

 

Here’s what I have tried so far:

 

Setup a policy using keywords and checked the “whole word” option.  DLP is setup to ignore the period so it detects “domain” AND “domain.com”.

 

Created the following regex:  “aexp[ ]”  This will exclude “domain.com” but also excludes any instance where “domain” occurs at the end of a sentence (“domain.”)

 

Created a DI with a list of keywords.  Tried different validators such as “Exclude Exact Match” (domain.com),  “Exclude Suffix” (.com), “Exclude Ending Characters” (.com).  It doesn’t seem that any of the validators are being applied so “domain.com” continues to be detected.

 

If anyone has a solution, I would be very appreciative.

[Fady azab]

Hi 

There is an idea on my mind , it may work 

 

1. create the detection rule with domain only 

2. create an exception with domain.com word

and check if it will work or not 

 

THanks 

 

[Russel Luz]

hi try using this in this on the exception 

create a regex policy and replace jack with your keyword

\bjack[.][aA-zZ]{2,3}([.][aA-zZ]{2})?\b

[arick dcosta]

The user is having trouble detecting "domain" without detecting "domain.com" using DLP EndPoint agent with Outlook integration. They have tried using keywords with the "whole word" option, regex, and DI with different validators, but none of them have worked. They are looking for a solution to this issue.