Create content classifiers

Data Loss Prevention | Forcepoint Web Security Cloud

Content classifiers can be used to identify intellectual property and data types that are not covered by the default Personally Identifiable Information (PII), Payment Card Industry (PCI), and Protected Health Information (PHI) rules. For example, a key phrase custom classifier can be created to identify a document marker, such as "Acme Corp - Internal Confidential".

The content classifiers that you create can then be used on the Data Security tab of your web policies.

If you are concerned only about data loss related to regulatory compliance, you can skip this step.

In the cloud portal, navigate to Web > Policy Management > Content Classifiers.

Click Add and select the type of classifier you want to create:

Key Phrase: a keyword or phrase that indicates sensitive or proprietary data (such as product code names or patents).

Regular Expression: a pattern used to describe a set of search criteria based on syntax rules.

For example, the pattern "a\d+" detects all strings that start with the letter "a" and are followed by at least one digit, where "\d" represents any digit and "+" represents "at least one."

Regular expression patterns are detailed in the Forcepoint Web Security Cloud help: see Regular expression content classifiers.

Dictionary: a container for words and expressions relating to your business.

Complete the fields as described in the appropriate section, and then click Save.

Key phrase content classifiers

Regular expression content classifiers

Dictionary content classifiers

Repeat steps 2-3 until you've added all the classifiers you require.

Regular expression content classifiers

Regular expression (regex) patterns can be detected within content, such as the pattern of an internal account number, or alphanumeric document code.

When extracted text from a transaction is scanned, the system searches for strings that match regular expression patterns and may be indicative of confidential information.

To create a regular expression classifier:

Enter a unique Name for the pattern.

Enter a Description for the pattern.

Enter the Regular expression pattern (regex) that you want the system to search for, using Perl syntax.

For syntax and examples, click Help > Explain This Page within the cloud portal, or view the help page at the following link: Regular expression content classifiers.

Use the Pattern Testing section of the page to test your regular expression.

Because regular expression patterns can be quite complex, it is important that you test the pattern before saving it. If improperly written, a pattern can create false-positive incidents.

Create a .txt file (less than 1 MB) that contains values that match this regex pattern. The file must be in plain text UTF8 format.

Browse to the file and click Test to test the validity of your pattern syntax. If the pattern you entered is invalid, you're given an opportunity to fix it. You cannot proceed until the test succeeds.

You can have up to 100 regular expression classifiers.

Key phrase content classifiers

The presence of a keyword or phrase (such as "Top Secret" or "Project X") in a web post may indicate that classified information is being exposed. You can learn about activity like this by defining a key phrase classifier.

To create a key phrase classifier:

Enter a unique Name for the key phrase classifier.

Enter a Description for the key phrase.

Enter the key word or phrase that might indicate classified information, up to 255 characters. Key phrases are case-insensitive.

Leading and trailing white spaces are ignored. If you need to use slashes, tabs, hyphens, underscores, or carriage returns, define a regular expression classifier rather than a key word classifier.

Key phrases also identify partial matches. For example, the key phrase "uri" reports a match for "security". Note that wildcards are not supported for key phrases.

You can have up to 100 key phrase classifiers.

Dictionary content classifiers

A dictionary is a container for words and expressions pertaining to your business.

To create a dictionary classifier:

Enter a unique Name for the dictionary classifier.

Enter a Description for the dictionary.

Dictionaries can have up to 100 phrases. To add content to the dictionary, click Add under Dictionary content.

Complete the fields on the resulting dialog box as follows:

Phrase: Enter a word or phrase to include. This phrase, when found in the content, affects whether the content is considered suspicious.

Weight: Select a weight, from -999 to 999 (excluding 0). When matched with a threshold, weight defines how many instances of a phrase can be present, in relation to other phrases, before triggering a policy.

If you have many phrases to include, create a text file listing the phrases, then click Import and navigate to the text file.

Mark The phrases in this dictionary are case-sensitive if you want the phrases that you entered to be added to the dictionary with the same case you applied.

You can have up to 100 dictionary classifiers. Each is limited to 100 phrases.

For examples and restrictions, click Help > Explain This Page.