Strata Cloud Manager

1. Log in to Strata Cloud Manager.
2. Select ConfigurationData Loss PreventionDetection MethodsData Patterns.
3. Click Add Data Patterns and select Custom.

   You can also create a custom data pattern by copying an existing one. To copy a custom data pattern, select its name to view the details and copy (

   ). You can then configure the copy as needed.
4. Enter a descriptive Data Pattern Name.

   If you update an existing data pattern, Enterprise DLP supports changing the name only if the data pattern isn't currently in use in a data profile or a Data Security (SaaS API) data asset policy rule. You must remove the data pattern from the data profile or data asset policy rule before you change the name.

   After you archive a data pattern, Enterprise DLP updates the data pattern name for all DLP incidents with the new archived data pattern name. It takes about 10 minutes for the new name to appear in the Incident Manager for existing and new incidents.
5. (Optional) Enter a Description for the data pattern.
6. Select the type of Regular Expression.

   You can choose Basic or Weighted data patterns. Use the Weighted data pattern to create a basic or weighted regular expression. With weighted regular expressions, you assign each text entry a score and when the score threshold is exceeded, such as when enough expressions from a pattern match an asset, Enterprise DLP indicates that the asset is a match for the pattern.

   Use the query builder in the Regular Expressions field to add Basic or Weighted expressions.
7. (Optional) Enter one or more Proximity Keywords.

   Proximity keywords aren't case-sensitive and increase the probability that Enterprise DLP accurately detects a regular expression match. Proximity keywords impact the Enterprise DLP confidence level, which reflects the likelihood that matched traffic is accurately detected. Enterprise DLP determines the confidence level by inspecting the distance of regular expressions to proximity keywords.

   Data patterns that don't include proximity keywords to identify a match always have both Low and High confidence level detections in a DLP incident.

   Custom regex data patterns can't detect Microsoft sensitivity labels stored in LabelInfo.xml within co-authored Microsoft Office documents. To detect these labels, use AIP Tags file property data patterns instead.
8. (Optional) Enter the Proximity Distance (between 1 and 1,000) to specify the maximum character distance between sensitive data and proximity keywords required to trigger a detection.

   The default proximity distance is 200.

   For large files or traffic containing sensitive data where related proximity keywords might be separated by longer text blocks, you can increase the proximity distance to ensure proper detection. Conversely, for files or traffic where you need tighter control to reduce false positives, you can specify a smaller proximity distance to ensure only closely associated keywords trigger a match.

   The minimum proximity distance must be the character length of the longest proximity keyword plus one character. Include spaces within the proximity keyword value in the character count.

   For example, consider the list of proximity keywords in the custom data pattern below. The longest proximity keyword is phone number, which is 12 characters. In this case, the minimum proximity distance is 13.

9. Save and Test the data pattern.
10. Review the Regex Analyzer results.

    If you update an existing data pattern, Enterprise DLP initiates the Regex Analyzer only if you add a new regex or edit an existing one. Enterprise DLP doesn't re-analyze unchanged regex.

    When you save a data pattern that contains regular expressions, Enterprise DLP automatically runs the Regex Analyzer to evaluate each expression for performance issues and compatibility with the optimized scan engine.

    Enterprise DLP analyzes your regex for the following:

    • Regex Efficiency—Checks each expression for patterns that can cause catastrophic backtracking or excessive processing time.
    • Optimized Engine Compatibility—Determines whether each expression is compatible with the optimized Enterprise DLP scan engine for high-performance detection.

    After the analysis completes, Enterprise DLP provides a detailed analysis breakdown for each discrete regex you added to the data pattern.

    • Regex Summary List
      Lists all the discrete regex in the data pattern and provides an at-a-glance analysis summary:
      • Efficient—Expression executes within acceptable performance thresholds and doesn't require changes.
      • Timed Out—Expression contains patterns that cause excessive processing time, such as nested quantifiers, unbounded wildcards, or constructs prone to catastrophic backtracking.
      Common patterns that cause expensive regex scan performance:

      • Leading unbounded wildcards—.*test.* (use test instead)
      • Nested quantifiers—(a+)+$ (use a+$ instead)
      • Unbounded dot-star with anchored suffix—.*\d{3}-\d{2}-\d{4}.* (use \d{3}-\d{2}-\d{4} instead)
    • Regex Analysis Details
      Enterprise DLP provides an analysis of your current regex and an AI-generated optimized version of your original regex. Enterprise DLP determines regex efficiency based on:
      • Scan Latency—Total time elapsed to detect sensitive data against the test file using the regex. Efficient expressions complete in under 10 seconds. Expensive expressions exceed the 10-second threshold, and Enterprise DLP interrupts them.
      • Scan File Size—File size used to test regex efficiency. Always displays 200 KB.
      Enterprise DLP also recommends a predefined or custom advanced detection method you can use instead of regex detection. Advanced detection methods can offer additional logic to increase detection accuracy, reduce false positive detections, and reduce scan latency.
      Enterprise DLP offers alternatives to your original regex, but you don't have to select a recommended regex or advanced detection method to save the data pattern after regex analysis completes.

    • Regex Intent
      An AI-generated summary of the intention of the regex detection. Review the Regex Intent to validate that your regex pattern detects the correct sensitive data.

    Click Save to save the data pattern.
11. Create a data profile on Strata Cloud Manager.