Copy and Customize a Data Identifier

You can copy a built-in data identifier and change the threshold and proximity on the copy to create your own customized data identifier. For a list of built-in data identifiers, see Built-in Data Identifiers.

Prerequisites

• Full admin access to the Umbrella dashboard. See Manage User Roles.

Procedure

1. Navigate to Policies > Policy Components > Data Classification.

2. Expand a Data Classification, then expand a built-in data identifier within that classification and click COPY & CUSTOMIZE.

   

3. Give the new data identifier a meaningful name and description. (Umbrella provides a default name which we recommend changing.)

   

4. Select Threshold or Unique Threshold and then specify the Severity Criteria. The Threshold value represents the total number of occurrences of this identifier that must be detected in a document for Umbrella to generate an incident. The Unique Threshold value represents the number of unique occurrences of this identifier that must be detected in a document for Umbrella to generate an incident. The default threshold is 1. A threshold of 10, for example, only generates an incident if 10 instances of the identifier are found in the file.
   To specify the Severity criteria:

   1. Select the severity name from the dropdown list. You can choose a predefined name or select Custom and then provide a name.

   2. Select the operator to define the value. You can select Range to define a range of the threshold value.

   3. Enter the threshold value or the range based on the selected operator.

      

5. To add proximity keywords, enter a proximity keyword in the proximity field and then click ADD. You can repeat this step to specify up to 10 proximity keywords to match against the pattern. If you specify proximity keywords, Umbrella will not generate an incident unless at least one of the occurrences of a matching term or pattern appears within 20 terms of a proximity keyword.

   

6. Click SAVE.

   

The custom identifier appears under Custom Identifiers when creating or editing a data classification. (See Create a Data Classification or Copy and Customize a Built-In Data Classification.)

👍

Pattern

The pattern field is the built-in regular expression designed for this identifier and cannot be edited.

Built-In Data Identifiers< Copy and Customize a Data Identifier > Create a Custom Identifier