Data Loss Prevention

 View Only
  • 1.  How to implement Exact Data Matching

    Posted Apr 10, 2017 01:39 PM

    Hello,

    My name is Raul Ramirez and i'm implementing one rule with Exact Data Matching, but i don't know how i have to do the mapping. I have the next record data:

    10001141              5553810040                  VALONCA ARNBLO LUISA                    BARDAHL

    where the first data is the account number, the second a telephone nomber, the third is the customer name and the last one the company. My question is . . . how i have to do the mapping because i can´t make that my policy generate one incident.

     

    Thanks



  • 2.  RE: How to implement Exact Data Matching

    Posted Apr 10, 2017 03:11 PM

    There's some pretty good information in the DLP Admin Guide

    Check out Section 4 - Authoring Policies, Chapter 20 - Detecting content using EDM

    There's sections there that describe configuring the data profile as well as tips on configuring the actual EDM policy.

     

    Good Luck!

    Let us know how it turns out

    Will



  • 3.  RE: How to implement Exact Data Matching

    Posted Apr 10, 2017 05:05 PM

    i've been readiing the document and till this moment is not possible to generate one inceident with EDM rule. I've been customized some fields and  i follow without get any results. Somebody could help me ?



  • 4.  RE: How to implement Exact Data Matching
    Best Answer

    Posted Apr 11, 2017 01:43 AM

    First, use MATCH and INDEX to retrieve the data from the Table.



  • 5.  RE: How to implement Exact Data Matching

    Posted Apr 11, 2017 03:57 PM

    Marlene, sorry but how i have to use MATCH and INDEX, could you explain please . . .



  • 6.  RE: How to implement Exact Data Matching

    Posted Apr 12, 2017 04:15 AM

    Hello,

     

    Did you create already the EDM profile (Manage / Data Profiles / Exact Data)? If yes, the mapping should be done at Policy level. Create a Policy that uses the EDM profile generated previously as detection rule and afterwards you should get a table to establish the mapping.

     

    BR,



  • 7.  RE: How to implement Exact Data Matching

    Posted Apr 12, 2017 06:41 PM

    Hello,


    I've been do all exactly  as you describes, let me show you the detail:

    First my file in csv format:

    EMPLEADO|NOMBRE  
    14115|RAMIREZ VILLELA JOSE ANTONIO
    16650|COBOS ARGUELLES RIGOBERTO
    17287|GUTIERREZ AVILA MARTHA EUGENIA
    17406|RIOS FERRER RICARDO
    19201|CATALINA NAVARRO DE ECHEVARRIA

    Second, Field Mappings
     
        
      EMPLEADO    CUENTA
      NOMBRE        Last Name

     

     I DON´T KNOW WHAT COULD BE THE ERROR . I HAVE ANOTHER POLICY SIMILAR AND THESE GENERATE THE INCIDENT.

    i THINK COULD BE THE MAPPINGS

     

     

     

     

     

     

     



  • 8.  RE: How to implement Exact Data Matching

    Trusted Advisor
    Posted Apr 13, 2017 08:17 AM

    hello,

    do you use EDM for network, email, web or endpoint policies ?

    did you get any errors when you generate EDM ?

    If you look at system events after genrating EDM, does number of line found in your input file is correct ?

    i think you are testing on your own by putting this data in your email, so you may add a "specific dlp test" keyword i it and corresponding rule in your dlp policy like "DLPSMTPTEST4EDM" so like that you will be sure that email were correctly processed by DLP and issue is only related to your policy rule.

     

    Regards.



  • 9.  RE: How to implement Exact Data Matching

    Posted Apr 17, 2017 01:11 PM

    Hello,

    I'm using EDM for network.

    No error when i generate EDM.

    I think everything is right.  So i don´t know what else to do . . ..

     

    Regards



  • 10.  RE: How to implement Exact Data Matching

    Posted Apr 20, 2017 04:16 PM

    Hello Raúl,

    What version of DLP do you have installed?



  • 11.  RE: How to implement Exact Data Matching

    Posted Apr 20, 2017 05:55 PM

    14.5 version.

     

    Thanks