Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/central/customer/help/en-us/index.html?contextId=CCL-advanced-create

Set up an advanced expression

Follow these instructions to set up an advanced expression for a custom Content Control List (CCL).

Restriction

Sophos Support doesn't provide assistance in setting up custom regular expression DLP rules. Contact Sophos Professional Services.

You must select Advanced Setup as the matching criteria for your custom CCL to set up an advanced expression.

To set up an advanced expression, do as follows:

  1. Set the Trigger score.

    This is the number of times the regular expression must match before the CCL is triggered.

  2. Enter a Perl 5 regular expression in Expression. For more information on Perl 5 regular expressions, see Perl syntax.

  3. Set the Score for the CCL.

    This number is added to the overall score when the regular expression matches the CCL.

    Note

    The Score must match the Trigger score.

  4. Set the Max count.

    This is the maximum number of times a regular expression match contributes to the total score.

    Example

    An expression with a Score of 5 and a Max count of 2 adds a maximum of 10 to the total score of a CCL. If the expression is found 3 times, it still adds 10 to the total score.

  5. Click Add.

  6. (Optional) Add more expressions, if required.

    Adding more expressions expands the scope of the CCL.

  7. Click Save.

Examples of matching criteria for an advanced expression

See the examples of matching criteria for a CCL with an advanced expression.

Example

A CCL has the following matching criteria:

  • Expression A has a score of 5 and a maximum count of 2.
  • Expression B has a score of 3 and a maximum count of 1.
  • Expression C has a score of 1 and a maximum count of 5.

We match it if we find any of the following combinations:

  • 2 matches for expression A.
  • 1 match for expression A and 1 match for expression B.
  • 1 match of expression B and 5 matches of expression C.