Data Loss Prevention

 View Only

  • 1.  Data Identifier only for Keywords (Keywords Dictionary )

    Posted Apr 26, 2013 04:13 AM

    Hi, 

    I want to create Data Identifier for only keywords. 

    Ex: Data1, Data2, Data3, Data4.

    Which could be included in the policy for unique keywords detection. And also is there other way to create policy on unique keywords detection

    Thanks



  • 2.  RE: Data Identifier only for Keywords (Keywords Dictionary )

    Trusted Advisor
    Posted Apr 26, 2013 07:29 AM

    Hi

     you can modify your rule with one keyword list in a compound rule with a subset of your keyword list in each sub rule. It is not the same as uniqueness (especially if you have lot of keywords) but it is better than having false positive incident which match several times on the same keyword.

     For data identifier, i never test it so cannot answer to this part of your question.

     

     regards



  • 3.  RE: Data Identifier only for Keywords (Keywords Dictionary )

    Posted Apr 26, 2013 07:39 AM

    Thank you Stephane.

    Yes,we can modify rule with subsets for better detection. 

    I am looking for soultion, where we can configure detection rule for unique keywords.

    ex: Key1, key2, key 3, key4 ( with match min 3)

    Trigger incident only when 3 keywords matchs, not like default detection rule key 1/2/3/4 apperes 3 times



  • 4.  RE: Data Identifier only for Keywords (Keywords Dictionary )

    Posted Jul 31, 2013 05:53 AM

    Hi,

    You can do it with Data identifiers, but only in a very limited way (keywords in ASCII only, and max 64 in one DI). Just enter your keywords into the DI in separate lines.

    What you need is a real unique keyword counting feature, which is unfortunately not implemented.
    I've started a feautre request voting for this earlier. Pleae consider to give a vote for it:

    https://www-secure.symantec.com/connect/ideas/unique-keyword-match-counting

    Regards,
    Barnabas