Skip to content

Set up an advanced expression

Follow these instructions to set up an advanced expression for a custom Content Control List (CCL).

Restrictions

  • These DLP rules are different than email data control policies. For information on email data control policies, see Data control policy.
  • Sophos Support doesn't provide assistance in setting up custom regular expression DLP rules. Contact Sophos Professional Services.

You must select Advanced Setup as the matching criteria for your custom CCL to set up an advanced expression.

To set up an advanced expression, do as follows:

  1. Set the Trigger score.

    This is the number of times the regular expression must be matched before the CCL is matched.

  2. Enter a Perl 5 regular expression in Expression.

    For a description of Perl 5 regular expressions see Perl syntax.

  3. Set the Score for the CCL.

    This is the number that is added to the total score for a CCL when the regular expression is matched.

    The Score must match the Trigger score.

  4. Set the Max count.

    This is the maximum number of matches for the regular expression that can be counted towards the total score.

    An expression with a Score of 5 and a Max count of 2 adds a maximum of 10 to the total score of a CCL. If the expression is found 3 times, it still adds 10 to the total score.

  5. Click Add.

  6. Add more expressions, if required.

    Adding more expressions expands the scope of the CCL.

Example

A CCL has the following matching criteria:

  • Expression A has a score of 5 and a maximum count of 2.
  • Expression B has a score of 3 and a maximum count of 1.
  • Expression C has a score of 1 and a maximum count of 5.

We match it if we find any of the following combinations:

  • 2 matches for expression A.
  • 1 match for expression A and 1 match for expression B.
  • 1 match of expression B and 5 matches of expression C.