Cisco IronPort AsyncOS 7.5 for Email Configuration Guide
Chapter11 Data Loss Prevention
Classifier Detection Rules
Classifiers require rules for detecting DLP violations in a message or document.
Classifiers can use one or more of the following detection rules:
Words or Phrases. A list of words and phrases that the classifier should look
for. Separate multiple entries with a comma or line break.
Regular Expression. A regular expression to define a search pattern for a
message or attachment. You can also define a pattern to exclude from
matching to prevent false positives. See Examples of Regular Expressions for
DLP, page 11-30 for more information.
Dictionary. A dictionary of related words and phrases. RSA Email DLP
comes with dictionaries created by RSA, but you can create your own. See
Chapter 14, “Text Resources” for more information.
Entity. Similar to smart identifiers in previous versions of AsyncOS, entities
identify patterns in data, such as ABA routing numbers, credit card numbers,
addresses, and social security numbers.
Classifiers assign a numeric value to the detection rule matches found in a
message and calculate a score for the message. The risk factor used to determine
the severity of a message’s DLP violation is a 0 - 100 version of the classifier’s
final score. Classifiers use the following values to detect patterns and calculate the
Proximity. How close the rule matches must occur in the message or
attachment to count as valid. For example, if a numeric pattern similar to a
social security number appears near the top of a long message and an address
appears in the sender’s signature at the bottom, they are probably not related
and the classifier does not count them as a match.
Minimum Total Score. The minimum score required for the classifier to
return a result. If the score of a message’s matches does not meet the
minimum total score, its data is not considered sensitive.
Weight. For each rule, you specify a “weight” to indicate the importance of
the rule. The classifier scores the message by multiplying the number of
detection rule matches by the weight of the rule. Two instances of a rule with
a weight of
results in a score of
. If one rule is more important for the
classifier than the others, it should be assigned a greater weight.
Maximum Score. A rule’s maximum score prevents a large number of
matches for a low-weight rule to skew the final score of the scan.