Advanced patterns use regular expressions (regex) that allow complex pattern matching, such as in social security numbers or credit card numbers. Definitions use the Google RE2 regular expression syntax.
Advanced pattern definitions include a score (required), as with dictionary definitions. They can also include an optional validator — an algorithm used to test regular expressions. Use of the proper validator can significantly reduce false positives. The definition can include an optional Ignored Expressions section to further reduce false positives. The ignored expressions can be regex expressions or keywords. You can import multiple keywords to speed up creating the expressions.
To ensure compliance with recent government regulations and simplify detection of personal information, more built-in advanced pattern definitions have been added. In addition, many validation algorithms have also been added. For information about the built-in advanced pattern definitions, see Trellix Data Loss Prevention Classification Definitions Reference Guide.
Important
When working with older Trellix DLP products, evaluating an advanced pattern with a regular expression might result in a false-positive. When the older Trellix DLP product doesn't support the new validation algorithm, the validation algorithm is ignored. If the regular expression matches but the value isn't valid based on the validation algorithm, the positive match reported is a false positive.
When defining an advanced pattern, you can choose how matches are counted: Count multiple occurrences increases the count with each match, Count each match string only one time counts how many defined patterns give an exact match in the document.
Advanced patterns indicate sensitive text. Sensitive text patterns are redacted in hit highlighted evidence.
Note
If both a matched pattern and an ignored pattern are specified, the ignored pattern has priority. This allows you to specify a general rule and add exceptions to it without rewriting the general rule.