Exact Data Matching (Enhanced) workflow

Export user records from a database to a .csv file or .tsv file.
Alternatively, you can use the pipe command to send user records from the database to the EDMTrain tool (fingerprint tool) for processing.
Execute the EDMTrain tool to train the data source file and generate the fingerprint file. For more information, see Preparing the fingerprint file for exact data matching.
Specify the CIFS share location of the .props file in ePO - On-prem. When the .props file is specified, ePO - On-prem also copies the .dis file to the evidence share location. Manually reupload the fingerprint file, if there is any change in the data source file. For more information, see Find an exact data match using EDM (Enhanced).
OR
Run the fileUpload API call for ePO - On-prem to copy the fingerprint file to the evidence share location. For more information, see Upload the fingerprint file using the REST API call.
Important
The upload process using both these methods copies the EDM database to a subdirectory called ExactDataFingerprints on all configured evidence shares. If you add or change an evidence share path, the EDM files are not synchronized automatically. You can either copy the contents of the ExactDataFingerprints subdirectory from an existing evidence share, or upload an updated fingerprint database for all existing data sources.
Define content classification criteria using the exact data matching criteria.
Choose the columns that you want to scan within the specified proximity. Optionally, you can specify the mandatory columns and exclude any combination of columns from matching. For more information, see Exact Data Matching (Enhanced) workflow.
Create a rule set with the EDM (Enhanced) classification criteria, apply it, and push the policy with the new rule set to the appliances.
OR
Create a scan using EDM (Enhanced) classification criteria, apply it, and push the policy to the Trellix DLP Discover.

EDM (Enhanced) workflow

How exact data matching works using EDM (Enhanced)?

EDM (Enhanced) allows associative matching of words in multiple fields (cells) of a user record and the rules are allowed based on:

Number of field (cells) matches — The number of field matches within the specified proximity constitute a record match (can appear in any order).
Proximity — The proximity is measured in terms of words. Proximity is the maximum permitted distance between adjacent fields that you can specify for field matches. You can set the proximity between 0–40 words.
Column values — Allows you to select the column values that must be found in a match and within the specified proximity. You can specify the Columns to scan for from the list of column values included in the fingerprint file. Optionally, you can specify the Mandatory columns that must be present for a record to match. You can also set Exceptions to exclude a combination of columns, which means that a match consisting of any combination of only the excluded columns isn't counted as a record match.

Choosing columns when creating content match criteria

Consider the following record from a dataset protected with EDM (Enhanced):

Full Name	Account Number	Customer number	Phone number	Email Address
John Doe	123-456-789	234567	+1-555-1234	john_doe@mycompany.example

You might decide that the data you don't want to leak is the combination of the account number with any information that can be used to identify the account owner.

If you specify the record match criteria as "at least 2 out of the 5 cell values with not more than 15 words between matched cell values", then add "Account number" as a mandatory column, any document containing the account number within the specified proximity of one or more other column values triggers a record match.

Consider:

Example A: John Doe has a telephone number +1-555-1234. He lives in New York and his account number is 123-456-789 with customer number 234567.
Example B: 123-456-789 234567

You might decide that the combination of "Account number" and "Customer number" does not constitute a leak, and is causing false positives in numeric spreadsheets, so you can create an exception for the match "Account number", "Customer number".

This means that the example B, 123-456-789 234567 is not a match.

But, those fields combined with any other cell will still be a match. Example A is still a match as "Full name" is combined with "Phone number", Account number", and "Customer number":

John Doe123-456-789234567