Video Screencast Help
Symantec Secure Login will be live on Connect starting February 25. Get the details here.

Unique keyword match counting

Created: 19 Mar 2013 | 3 comments
Barnabas's picture
16 Agree
0 Disagree
+16 16 Votes
Login to vote

Keyword based detection is the most simple detection type, but it is quite powerful. However as each match is counted separately, the following can not be done currently, only with EDM, which is not able to block on Endpoint:

We would like to block content which has eg. more than 6 keywords from a list of 200 keywords. Eg. stock names.

Unique keyword match counting could be very useful to overcome this.

Unique match counting works already with Data identifiers, but unfortunetely Data identifiers support only ASCII characters and a limited number of word lists (around 64).

Please consider this simple, but very useful detection enhancement request!

Comments 3 CommentsJump to latest comment

Tariq Naik's picture

I think this should be the top priority request. It will make life for in Incident Management Team much more easier.

Login to vote
kishorilalWipro's picture

I am Also agree with the same, this will enhance the accuracy

Login to vote
Daniel H's picture

With the 64 limit entry, you may want to use the text normalizer so that detection can occur for upper and lower case.

Login to vote