Set up an advanced expression

Follow these instructions to set up an advanced expression for a custom CCL.

You can only do this as part of creating a custom CCL.

Select Advanced Setup as the matching criteria to enter the details for an advanced expression:

  1. Set the Trigger score.

    This is the number of times the regular expression must be matched before the CCL is matched.

  2. Enter a Perl 5 regular expression in Expression.

    For a description of Perl 5 regular expressions, refer to Perl documentation or go to Perl syntax.

  3. Set the Score for the CCL. This is the number that is added to the total score for a CCL when the regular expression is matched.
    Note The Score must match the Trigger score.
  4. Set the Max count. This is the maximum number of matches for the regular expression that can be counted towards the total score.

    For example, an expression with a Score of 5 and a Max count of 2 can add the maximum of 10 to the total score of a CCL. If the expression is found 3 times, it still adds 10 to the total score.

  5. Click Add.

    To delete an expression, click Delete Blue cross mark.

    To edit an expression, click Edit Blue pen. Once you have finished your edits , click Save Blue check mark to save them.

  6. Add more expressions, if required.

Adding more expressions expands the scope of the CCL.

For example, the following CCL is matched if Data Loss Prevention finds 2 matches of expression A or 1 match of expression A and 1 match of expression B, or 1 match of expression B and 5 matches of expression C.

Expression

Score

Max count

Expression A

5

2

Expression B

3

1

Expression C

1

5