Print Download PDF Send Feedback

Previous

Next

Advanced Options for Data Types

These Data Types have several advanced options you can edit only from GuiDBedit:

To open the options for these Data Types:

  1. Run: c:\Program Files\CheckPoint\SmartConsole\R80.10\PROGRAM\GuiDBedit.exe
  2. Connect to the Security Management Server.
  3. Go to Table > Other > dlp_data_tbl and select the Data Type that you want to change.

Case Sensitivity

Applies to Data Types:

By default, DLP finds text strings in uppercase or lowercase. You can choose to only find text that matches the case of the words in the Data Type lists.

To find text strings only when the case of the characters matches:

Note - The Case Sensitivity option applies to ASCII words. Non-ASCII words are always case sensitive.

Ordered Match for Names

Applies to Data Types:

By default, DLP finds dictionary words exactly as they are listed in the dictionary file. DLP will not find the dictionary words if they are in a different order. You can configure DLP to find dictionary words even if they occur in a different order.

This is important when DLP looks for names of people that are in a different order. For example, if your dictionary file includes the name “John Smith”, DLP will find only “John Smith”. By default, DLP will not find “Smith John” in sent messages.

To find dictionary entries in any order:

Proximity of Matched Words

Applies to Data Types:

DLP can use the proximity of dictionary words to each other as a criteria in the DLP rules. With this option, if DLP finds the words far from each other, DLP will not trigger an action.

For example, if your dictionary file contains confidential and information and the proximity check is enabled, DLP will detect messages in which these words are within 3 words of each other. In this example:

The dictionary rule will match the text: This email contains confidential company information.

The dictionary rule will not match the text: This information about our product is not confidential.

To enable DLP to check the proximity of dictionary words:

To change the value of how near the dictionary words need to be to each other:

Match Multiple Occurrences

Applies to Data Types:

DLP scans messages for words that are included in your lists. DLP can record a match for each occurrence of a word in the text, or DLP can record a match once regardless of how many times the word is used in the text.

By default, Patterns are recorded as a match each time the pattern is used in the text, but Dictionary words and Keywords are recorded as a match only once regardless of how many times they are used in the text.

To record a single match regardless of how many times a word is used:

To record a match for every time a word is used:

Match Whole Word Only

Applies to Data Types:

DLP can match text as partial or whole words. For Weighted Keywords and Patterns, you can choose to match only whole words. Dictionary or Keywords Data Types are always matched when they appear as a whole word only.

For example, if your Pattern Data Type contains (C|c)onfident and the whole word only option is enabled, DLP will only match patterns that do not have characters before or after the pattern. In this example:

The Data Type will match the text: confident

The Data Type will not match the text: confidential

To match whole words only:

Note - Languages in which words are not bounded by white spaces or punctuation symbols, such as in Japanese or Chinese, will never match as whole word only.