Create a Custom Identifier

A custom identifier can be used as part of a data classification to define terms and pattern expressions a DLP rule must match to generate an incident. You can optionally further restrict matching criteria using additional qualifiers:

• Specify a threshold, to indicate the minimum number of occurrences of a term or pattern that must appear within a document to qualify as a match.

• Specify proximity keywords, at least one of which must appear within 20 terms of a term or pattern to qualify as a match.

If you specify both a threshold and proximity keywords, a document is considered a match only if it contains a custom identifier term or pattern that appears at least the number of times indicated by threshold, and at least one of those occurrences appears within 20 terms of at least one of the proximity keywords.

NOTE: Umbrella blocks documents containing a custom identifier only if the identifier is surrounded by a word boundary. A document containing a custom identifier with an alphanumeric character (a-z, A-Z, 0-9) adjacent to it will not be blocked. For example, for the custom identifier c.t matches cat and cot, but not housecat or citation.

Once you create a custom identifier, you can add it to a data classification. To create a data classification, see Create a Data Classification or Copy and Customize a Built-In Data Classification.

Prerequisites

• Full admin access to the Umbrella dashboard. See Manage User Roles.

Procedure

1. Navigate to Policies > Policy Components > Data Classification.

2. Click Add Custom Identifier.

3. Give the custom identifier a meaningful name and description.

4. (Optional) Specify the threshold for your identifier. (Legal range: 1 - 300.) This represents the number of occurrences of this identifier that must be detected in a document for Umbrella to generate an incident. A threshold of 3, for example, only generates an incident if 3 instances of the identifier are found in the file. The default threshold is 1.

5. (Optional) Specify up to 10 proximity keywords for your custom identifier. If you specify proximity keywords, Umbrella will not generate an incident unless at least one of the occurrences of a matching term or pattern appears within 20 terms of a proximity keyword. Then click Add.

6. Add terms and patterns to your custom identifier.
   Note: Terms and patterns cannot be uploaded or entered as a CSV. Each term must be entered individually.

   a. For Terms, add up to 100 terms and click Add for each term.

   

b. For Pattern, enter a regular expression 3-1,000 characters long. You can add up to 10 patterns to a custom identifier. For more information, see Custom Regular Expression Patterns.
After adding a regular expression, you can enter sample text in the Test box, and click Test to verify the pattern matches.
Click Add when you are satisfied that you have the pattern you want.

7. Click Save.

Your custom identifier appears under Custom Identifiers when editing or creating a data classification. (See Create a Data Classification or Copy and Customize a Built-In Data Classification)

---

Copy and Customize a Data Identifier < Create a Custom Identifier > Custom Regular Expression Patterns