What are the parameters that determine how far apart EDM keyword matches can be in order to trigger a policy?

Products

• Data Loss Prevention Network Monitor
• Data Loss Prevention Enforce
• Data Loss Prevention Network Discover
• Data Loss Prevention Network Protect
• Data Loss Prevention Endpoint Discover

Issue/Introduction

What determines the proximity of EDM tokens to be considered a match?

Resolution

QUESTION

If I am looking for two elements, such as Name and SSN, in a EDM, what is the Symantec DLP parameter related to how far apart in a document they can be for a match?

ANSWER

The following settings within the Advanced Server Page determine the proximity of EDM tokens.

 

EDM.RunProximityLogic 

If this value is true, then DLP uses the token proximity check.

• If EDM.RunProximityLogic = false it will match based on the entire document without proximity.
• If EDM.RunProximityLogic = true it will only match within the proximity range.

• The free-form (a.k.a. simple) text proximity is defined by EDM.SimpleTextProximityRadius setting.
• The tabular text proximity is defined by belonging to the same table row.

 

EDM.SimpleTextProximityRadius 

This is the number of tokens to the left and to the right of the current token that are evaluated together when the proximity check is enabled.