The Exact Data Matching (EDM) feature enables you to protect sensitive database records by only matching the actual values from the original records. Employee records, customer records, and patient medical records are typical examples of sensitive information that needs protection. Although you can protect such records by matching patterns and dictionary terms, these methods of data matching require complex condition and rule logic, which are prone to false matching.
Important
The version of EDM in Trellix DLP Network Prevent v11.6, Trellix DLP Network Monitor v11.6, Trellix DLP Discover v11.7 and earlier releases is superseded with EDM (Enhanced), which is a more scalable solution. While this release continues to support both versions of EDM, we recommend that you move to the newer EDM version as the previous EDM solution will be removed in a future Trellix DLP product release. For more information, see Upgrade path for using EDM (Enhanced).
Matching individual fields of a sensitive record (such as, name, date of birth, telephone number, city) might not be useful and can easily result in a false match. But matching two or more fields of the same sensitive record (for example, both name and social security number) within the same text (such as, an email or a document) indicates that meaningful related information is present.
EDM enables associative matching of multiple fields from the same record, allowing rules based on:
Number of field matches that constitute a record match
Required proximity of field matches
Number of record matches that constitute an EDM classification criteria match
The workflow requires you to:
Prepare the sensitive data in a CSV file format.
Upload the CSV file directly into ePO - On-prem. For large data sets that contain for than 100,000 rows, upload the CSV file using the CSV2Fingerprints.exe utility. These upload options are available when you click Upload file in the Classification → Registered Documents page.
The CSV data is converted into an opaque hashed fingerprint format.
After you upload the CSV file into ePO - On-prem, define classification criteria using the associative matching criteria.
Example
Consider you have this data record in a CSV file that has to be protected:
First Name | Last Name | Credit Card Number | Social Security Number | Phone number |
John | Doe | 1111222233334444 | 12345678 | +1 9876543210 |
In the Exact Data Fingerprints Match Criteria page, try to match using "if at least 5 cell values out of 5 cell values… ". If a user sends an email with "Doe John CCN is 1111222233334444…", this will not match the CSV row because there is a need to match at least 5 columns. The email doesn't get blocked; but the CCN gets leaked.
In this CSV example, consider you want to prevent an individual's credit card number and social security numbers being leaked and you use the criteria "if at least 2 cell values out of 4 cell values...", without considering the "Phone number" column. In this case, you can potentially get many false EDM triggers for different combinations of data triggered from columns 1, 2, 3, and 4.
When defining the EDM criteria, we recommend you carefully analyze how many columns to match on and make the criteria as tight as possible. For example, use the criteria "if at least 3 cell values out of 4 cell values..." to protect data containing first name, last name, and CCN, or first name, last name, and SSN without causing false triggers.
Creating and fingerprinting a CSV file
We recommend not to use common values in a CSV file. The values must be unique to get the best results while using EDM. Analyze the data that you want to protect (match) and make sure it is a meaningful match value. All values in the CSV file are indexed in the fingerprint file, regardless of the definition you use in classifications.
Fingerprint files are created automatically by uploading CSV files to ePO - On-prem or for large data sets with more than 100,000 rows, upload the CSV file using the CSV2Fingerprints.exe utility and using the Create package feature. A fingerprint file is created and the hash of the CSV cell is added to a fingerprint file. This file is copied to the evidence network storage share folder, where Trellix DLP Discover, Trellix DLP Network Prevent, and Trellix DLP Network Monitor pick it up to use in classification and remediation scans.
Note
In scenarios where there is a difference between the available fingerprint files on the appliance and the expected fingerprint files as defined in the policy, the policy push gets temporarily rejected. This can happen if the .zip file containing new fingerprints is still being downloaded and processed, and a new policy is pushed by ePO - On-prem containing references to fingerprint files that are not yet processed. After the fingerprint file processing is complete, the next policy push succeeds (unless you add new fingerprints and policy, in which case the policy push gets temporarily rejected again). The Appliance Management dashboard shows it as a corrupt policy. This is a temporary issue until the next push of the policy.
How to specify special characters in a CSV file?
The text containing special characters, such as backslash (\), double quotes (""), and comma (,), which are used as CSV values, must be entered in the CSV file as shown in these examples:
Description | Example | Entry in the CSV file |
|---|---|---|
Text containing comma — include the text in double-quotes | Virgin Islands, British | "Virgin Islands, British" |
Text containing double quotes — include the backslash character as an escape character for the quotes | "Hello" | \"Hello\" |
Text containing backslash character — include the backslash character as an escape character for the backslash character itself | \\share\file | \\\\share\\file |
Creating EDM classification criteria
The input for creating an EDM classification can have the following values:
Exact Data Fingerprints Records — Matches the specific CSV file
Single record match criteria — Matches a record in a file, for example, "at least X out of Y cell values appear in the text, in any order, less than Z characters apart"
Number of records to match — For example, "find at least X records in the analyzed text"
Supported languages
EDM can scan traffic in all languages except languages that do not use whitespace characters or punctuation marks for breaking words. For example, Chinese and Japanese.
Limitations
The first line of the CSV file must be a header of column names.
Fingerprints can be uploaded as CSV or .zip files only. CSV files must be comma delimited and can't contain more than 100,000 records or rows (excluding the header) when invoking the utility from the UI.
Note
Automatic fingerprint creation is limited to files with less than 100,000 records. For larger CSV files, download the utility and create files manually using a command line or by drag-and-drop on the utility.
Fingerprints are not created for cells with fewer than three characters.
A column name can't contain more than 100 characters.
Phone numbers in the fingerprint file only match identical numbers in text files. For example, a phone number entered in the CSV without a country code doesn't trigger a match with the same number in the text file if it includes the country code.
The first and last names in a single column only match if they are in the same order. If the CSV column contains first name - last name, and the text file contains last name - first name, it doesn't trigger a match.
Note
You can avoid this limitation by placing first and last names in separate columns.
Backward compatibility
A classification with an EDM condition sent to any Trellix DLP product version earlier than Trellix DLP Discover version 11.1 or Trellix DLP Network version 11.4 is ignored.
If the criterion contains multiple conditions — for example, Advanced Patterns AND Dictionaries AND EDM — it is evaluated based on the conditions that are recognized, and EDM is ignored.
If the criterion contains only EDM, the criterion is considered empty and is evaluated as false, that is — as a non-match.