Fingerprint

Technical Library | Support

Go to the table of contents

Go to the previous page

Go to the next page

View or print as PDF

Creating Custom DLP Policies > Selecting a content classifier > Fingerprint

Administrator Help | TRITON AP-DATA | Version 8.3.x

Related topics:

There are 2 types of fingerprint classifiers that can be added: files or database records. The General tab displays all classifiers from both types. Sort or filter columns to help you locate the classifier you need.

If you highlight a database records classifier, the bottom of the screen displays the field (or column) names of the selected table. Select the fields you want to have scanned. You can select up to 32 fields per table.

For endpoints, the number of fields you select for a database fingerprinting classifier can affect accuracy. For the most accurate results, you should scan 3 or more fields. If you want to scan only one field for this rule, Forcepoint recommends that you set a minimum threshold of 5 to reduce the likelihood of unintended matches. (In other words, trigger an incident when there are 5 or more matches on this field.) If you do not, the system changes the threshold for you.

If you want to scan 2 fields, then set the minimum threshold to 3 or more. (Trigger an incident when 3 or more field1/field2 combinations are detected.)


Number of Fields Chosen	Minimum Threshold
1	5
2	3
3 or more	1

Select the Properties tab to configure a threshold.


	Note If you are defining a condition for both network and endpoint resources, the threshold is changed for the endpoint only. Network resources retain the threshold you define on the Properties tab.

For more information on creating fingerprint classifiers, see Database fingerprinting.

Go to the table of contents

Go to the previous page

Go to the next page

View or print as PDF

Creating Custom DLP Policies > Selecting a content classifier > Fingerprint

Copyright 2016 Forcepoint LLC. All rights reserved.