Find an exact data match using EDM (Enhanced)

Specify the fingerprint file of the data source file that you want to protect from being leaked.

1. In ePO - On-prem, select Menu → Data Protection → Classification.

2. On the Register Documents tab, select Exact Data Fingerprints from the Type drop-down list.

3. Click Add EDM datasource and then click New EDM solution.

4. In the Link Fingerprint File for Exact Data Matching page, specify the shared storage location of the .props file and authorization credentials.

   

5. Click OK.

   The fingerprint file for exact data matching gets linked.

OR, run the fileUpload API call for ePO - On-prem to copy the fingerprint file to the evidence share location.

Note

When you upload an updated fingerprint file (revisions made to the same file) with a change to the column order, column names, or number of columns, a message similar to the following is shown.

Number and/or name(s) of columns differ from existing data: \\<cifsshare_location>\<filename>.dis

OR

The columns list do not match for the props file of {dis file name}

You must re-create the fingerprint file if any of this message is shown and then re-create the content classification criteria.

Create or add an exact data match content classification criteria.

1. In ePO - On-prem, select Menu → Data Protection → Classification.

2. Create a classification — select Actions → New Classification in the classifications list. You can also add an exact data matching condition to an existing classification.

3. Select Actions → New Content Classification Criteria.

4. From the Data conditions list, select Exact Data Matching, and select Using EDM (Enhanced).

   Note

   Selecting the Using option uses the older version of EDM classification. You can use either EDM or EDM (Enhanced) in your classification, but not both.

5. Click the choose icon () next to the Value field.

   

   The Exact Data Fingerprints Match Criteria page appears.

   Enter these values for creating the EDM (Enhanced) classification criteria:

   • Data source — Specify the data source file for exact data matching.

   • Columns to scan for — Select the column values that must be found in a match.

   • Single record criteria — Matches a record in a file, for example, "atleast X out of Y cell values appear in any order in the text and not more than Z words between the matched cell values." Z is the proximity value and it is the maximum permitted distance between the adjacent fields.

   • Number of unique records — For example, "find at least X records in the analyzed text".

   • Mandatory columns — (Optional) Select the mandatory columns that must be present for a record to match.

   • Exceptions — (Optional) Select a combination of columns you want to exclude from matching, which means that a match consisting of any combination of only the excluded columns will not count as a record match.

6. Click OK.

(For Trellix DLP Network only) Create a rule set that includes an email, web, or network communication protection rule. While creating the rule, specify the exact data matching classification that you created in Condition → Classification field.

For information about how to create a rule set and adding a rule to a rule set, see Create a rule set and Create a rule with classification grouping.

(For Trellix DLP Network only) Assign rule sets to a policy. Before you assign rule sets to a policy, activate the rule set.

For more information, see Assign rule sets to policies.

(For Trellix DLP Network only) Assign and push the policy to Trellix DLP Network.

For more information, see Assign and push a policy to a system.

(For Trellix DLP Discover only) Create a network discovery rule for a remediation scan.

1. In the DLP Policy Manager, open a rule set or create one.

2. On the Discovery tab, select Actions → New Network Discovery Rule, then select one of the repository types supported by the feature (File Server, SharePoint, Box, or Database).

3. Select the classification you created in Step 2 and a repository that matches the selected type. Fill in the rest of the fields, and click Save.

(For Trellix DLP Discover only) Run the scan.

1. In Trellix DLP Discover, on the Scan Operations page, select Actions → New Scan then select the appropriate repository type.

2. Select the scan type (Classification or Remediation) and fill in the other fields as needed.

3. On the Repositories tab, select a repository.

4. (For remediation scan type) On the Rules tab, select the rule set that includes the rule created in Step 6. (For classification scan type) On the Classification tab, select the classification created in Step 2.

5. Click Save.

6. Click Apply policy.