Proximity Use Cases

Skyhigh Built-In Advanced Pattern List and Dictionary List

Suppose you have a financial document that contains confidential information or sensitive keywords that should only be accessed by authorized personnel. To ensure the security of the document, you can configure the criteria of your proximity classification. Set a proximity limit of 20 characters between Skyhigh built-in advanced patterns, such as Australian Business Number, Australian Company Number, ABA RTN, and Skyhigh built-in dictionaries such as Australian PII Keywords. Specify a threshold for the minimum number of occurrences, such as 10, to trigger a match. This means a match will only be triggered if the patterns for Australian Business Number, Australian Company Number, ABA RTN, and keywords for Australian PII appear close together (within 20 characters) at least 10 times within the document.

To configure the criteria for proximity classification, including proximity limit, Skyhigh built-in advanced patterns, Skyhigh built-in dictionaries, and frequency threshold, follow these steps:

1. Create a classification by defining the proximity between Skyhigh's built-in advanced patterns and Skyhigh's built-in dictionaries. Perform the initial steps of creating your proximity classification as provided in steps 1 to 5 in the Create a Classification using Proximity topic.
2.  Configure the following to define your proximity classification criteria:
   • Proximity is less than <number> characters. Enter a number to specify how close the values must appear. The number of characters should be between 1 and not more than 99,999 characters.
     For Example: If you enter 20, the two values must appear within 20 characters of each other to trigger the classification criteria.
   • between: Select Criteria. Click to select the values to specify proximity for. The values should be an advanced pattern and a dictionary. Select the following:
     • Advanced Pattern. Select one or more Skyhigh Predefined Advanced Patterns from the side panel.
       
     • Dictionary. Select one or more Skyhigh Predefined Dictionaries from the side panel.
   • and found at least <number> times. Enter a number to specify how many times the values must appear in proximity to each other to trigger the classification criteria. For example, enter 10. 
   • Count each match string only one time. When you select this checkbox, a string that matches one of the conditions (advanced pattern/dictionary/keyword) on either side of the proximity rule will not be counted again.
     
3. Click Save.  

Custom Advanced Pattern List and Dictionary List

Suppose you have a financial document that contains confidential information or sensitive keywords that should only be accessed by authorized personnel. To ensure the security of the document, you can configure the criteria of your proximity classification. Set a proximity limit of 20 characters between custom advanced patterns, such as UK Business Numbers, and custom built-in dictionaries such as UK Bank Keywords. Specify a threshold for the minimum number of occurrences, such as 10, to trigger a match. This means a match will only be triggered if the patterns for UK Business Numbers and keywords for UK Banks appear close together (within 20 characters) at least 10 times within the document.

To configure the criteria for proximity classification, including proximity limit, custom advanced patterns, custom dictionaries, and frequency threshold, follow these steps:

1. Create a classification by defining the proximity between custom advanced patterns and custom built-in dictionaries. Perform the initial steps of creating your proximity classification as provided in steps 1 to 5 in the Create a Classification using Proximity section.
2.  Configure the following to define your proximity classification criteria:
   • Proximity is less than <number> characters. Enter a number to specify how close the values must appear. The number of characters should be between 1 and not more than 99,999 characters.
     For Example: If you enter 20, the two values must appear within 20 characters of each other to trigger the classification criteria.
   • between: Select Criteria. Click to select the values to specify proximity for. The values should be an advanced pattern and a dictionary. Select the following:
     • Advanced Pattern. Select one or more Custom Advanced Patterns from the side panel.
       
     • Dictionary. Select one or more Custom Dictionaries from the side panel.
       
   • and found at least <number> times. Enter a number to specify how many times the values must appear in proximity to each other to trigger the classification criteria. For example, enter 10. 
   • Count each match string only one time. When you select this checkbox, a string that matches one of the conditions (advanced pattern/dictionary/keyword) on either side of the proximity rule will not be counted again.
     
3. Click Save.

Skyhigh Built-In Dictionary List and Custom Dictionary List

Suppose you have a financial document that contains confidential information or sensitive keywords that should only be accessed by authorized personnel. To ensure the security of the document, you can configure the criteria of your proximity classification. Set a proximity limit of 20 characters between Skyhigh built-in dictionaries, such as Acquisition, Bank ABA, and custom dictionaries such as Australian Bank Keywords. Specify a threshold for the minimum number of occurrences, such as 10, to trigger a match. This means a match will only be triggered if the keywords for Acquisition, Bank ABA, and keywords for Australian Banks appear close together (within 20 characters) at least 10 times within the document.

To configure the criteria for proximity classification, including proximity limit, Skyhigh built-in dictionaries, custom dictionaries, and frequency threshold, follow these steps:

1. Create a classification by defining the proximity between Skyhigh built-in dictionaries and custom dictionaries. Perform the initial steps of creating your proximity classification as provided in steps 1 to 5 in the Create a Classification using Proximity section.
2.  Configure the following to define your proximity classification criteria:
   • Proximity is less than <number> characters. Enter a number to specify how close the values must appear. The number of characters should be between 1 and not more than 99,999 characters.
     For Example: If you enter 20, the two values must appear within 20 characters of each other to trigger the classification criteria.
   • between: Select Criteria. Click to select the values to specify proximity for. The values should be dictionaries. Select the following:
     • Dictionary. Select one or more Skyhigh Predefined Dictionaries and Custom Dictionaries from the side panel.
       
   • and found at least <number> times. Enter a number to specify how many times the values must appear in proximity to each other to trigger the classification criteria. For example, enter 10. 
   • Count each match string only one time. When you select this checkbox, a string that matches one of the conditions (advanced pattern/dictionary/keyword) on either side of the proximity rule will not be counted again.
     

3. Click Save.

Skyhigh Built-In Advanced Pattern List and Custom Advanced Pattern List

Suppose you have a financial document that contains confidential information or sensitive keywords that should only be accessed by authorized personnel. To ensure the security of the document, you can configure the criteria of your proximity classification. Set a proximity limit of 20 characters between Skyhigh built-in advanced patterns, such as Australian Business Number, Australian Company Number, ABA RTN, and custom advanced patterns such as Australian Business Numbers. Specify a threshold for the minimum number of occurrences, such as 10, to trigger a match. This means a match will only be triggered if the patterns for Australian Business Number, Australian Company Number, ABA RTN, and patterns for Australian Business Numbers appear close together (within 20 characters) at least 10 times within the document.

To configure the criteria for proximity classification, including proximity limit, Skyhigh built-in advanced patterns, custom advanced patterns, and frequency threshold, follow these steps:

1. Create a classification by defining the proximity between Skyhigh built-in advanced patterns and custom advanced patterns. Perform the initial steps of creating your proximity classification as provided in steps 1 to 5 in the Create a Classification using Proximity section.
2.  Configure the following to define your proximity classification criteria:
   • Proximity is less than <number> characters. Enter a number to specify how close the values must appear. The number of characters should be between 1 and not more than 99,999 characters.
     For Example: If you enter 20, the two values must appear within 20 characters of each other to trigger the classification criteria.
   • between: Select Criteria. Click to select the values to specify proximity for. The values should be advanced patterns. Select the following:
     • Advanced Pattern. Select one or more Skyhigh Predefined Advanced Patterns and Custom Advanced Patterns from the side panel.
       
   • and found at least <number> times. Enter a number to specify how many times the values must appear in proximity to each other to trigger the classification criteria. For example, enter 10. 
   • Count each match string only one time. When you select this checkbox, a string that matches one of the conditions (advanced pattern/dictionary/keyword) on either side of the proximity rule will not be counted again.
     
3. Click Save.

Count Unique Matches

Suppose you have an email thread with unique and non-unique instances of sensitive keywords appearing in proximity. You can use this feature to reduce false positives by eliminating duplicate matches during the DLP policy evaluation.

Refer to the sample email thread below for an example of the use case:

► View the Sample Email Thread

Subject: Hello

How are you?

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.

Fred, Aylesbury

 

Subject: R.E Hello

I'm fine

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.

Peter, Thame

 

Subject: R.E. R.E. Hello

Good

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.

Fred, Aylesbury

NOTE: You can also view the details for matches, including the number of unique and non-unique matches. For details, see Classification Match Results.

To protect sensitive data in the email thread, you can create a proximity classification using custom dictionaries with unique match criteria. This classification alerts the DLP scanning engine to count a string only once when it matches one of the conditions (custom dictionaries) on either side of the proximity rule.

To create a proximity classification using custom dictionaries with unique match criteria, follow these steps:

1. Create custom dictionary classification(s) for the following dictionaries:
   • User Names: Include keywords for user names such as Fred and Peter. For example, create a custom dictionary named First Names including these keywords.
     
   • Addresses: Include keywords for addresses such as Aylesbury and Thame. For example, create a custom dictionary named Addresses including these keywords.
     
2. Create a proximity classification by defining the proximity between the custom dictionaries and enabling the unique match criteria. Perform the initial steps of creating your proximity classification as provided in steps 1 to 5 in the Create a Classification using Proximity section.
3. Configure the following to define your proximity classification criteria:
   1. Proximity is less than <number> characters. Enter a number to specify how close the values must appear. The number of characters should be between 1 and not more than 99,999 characters.
      For example: If you enter 50, the two keywords must appear within 50 characters of each other to trigger the classification criteria.
   2. between: Select Criteria. Click to select the dictionaries to specify proximity. Select the following:
      1. Dictionary. Select the newly created custom dictionaries from the side panel. For example, select First Names and Addresses.
         
   3. and found at least <number> times. Enter a number to specify how many times the keywords must appear in proximity to each other to trigger the classification criteria. For example, enter 1. 
   4. Count each match string only one time. When you select this checkbox, a string that matches one of the conditions (advanced pattern/dictionary/keyword) on either side of the proximity rule will not be counted again. For example, if you select this checkbox, the proximity rule will trigger three matches. Else, the proximity rule will trigger only two matches, because the non-unique match pair (Fred, Aylesbury) is not counted again. For details, see Classification Match Results.
      
4. Click Save.

Once you create the proximity classification, you can use it in your DLP policies for email services. This enables the DLP engine to detect and trigger matches for sensitive keywords that appear close together within the sample email thread, based on your new classification.