PC´s cant register XLS with policy of code postal.

Hello cristianodias,

I assume you also don't get an alert when, for example, you copy to a USB stick.

You could turn on verbose logging on the endpoint - this would show if there's at least some partial match. I doubt though that you will get any useful output. You have selected Postal addresses (Spain) and while the description says Addresses where the first line of the address or post code are provided (emphasis mine) I don't think it will trigger on just a set of 5-digit numbers (as the rule should apply to all kinds of documents alike the column heading Codigo Postal has likely no significance).
As a test please create an XLS with ten or more (complete) addresses and check whether this triggers an alert.

Christian

Hello cristianodias,

I assume you also don't get an alert when, for example, you copy to a USB stick.

You could turn on verbose logging on the endpoint - this would show if there's at least some partial match. I doubt though that you will get any useful output. You have selected Postal addresses (Spain) and while the description says Addresses where the first line of the address or post code are provided (emphasis mine) I don't think it will trigger on just a set of 5-digit numbers (as the rule should apply to all kinds of documents alike the column heading Codigo Postal has likely no significance).
As a test please create an XLS with ten or more (complete) addresses and check whether this triggers an alert.

Christian

Hi , this test i to try to webmail office365.

I test with complete addresses but dont register.

I undestarnd the complente address is for example:

Pepito vila, 22 "Edifici Star" Planta 1ª

08171 - Sant Cugat del Vallès (Barcelona)

I would like undestarnd the format of file to detect a rule.

For example , i to try one rule numbers of accounts Banks , then this case with format of document are detect ?

i to try créate one document with more the register of  International Bank Account Number (IBAN) but dont register.

Have any information of sophos to explain how to use the rules and your format ?

Thanks so much ,

Hello cristianodias,

I've never used DLP in production and it's years since the last tests.
Tried your example without success. It did work with something like
Organismo Autónomio Correos y Telégraphos
   Area de Asuntos Internacionales
   Calle Aduana, 29                     
   28070 MADRID
in a plain txt file, but it failed with a PDF. Though simple rules (like Confidential documents) did work with the PDF as well - this suggests it's not completely dysfunctional. I remember that I did test IBANs and CCNs with different file formats (PDF, XLS, ...), DLP might have been be picky on the format though (i.e. whether it's all one string or a number of blocks).

The DLP forum isn't actually read-only it seems but it looks orphaned. As DLP has been added to Central though it seems it isn't dead. AFAIK there isn't any detailed documentation on the predefined CCLs and what exactly they (are able to) detect. So unfortunately I can only suggest that you try to contact Sophos through the partner/reseller or perhaps directly. 

Christian

Hi Christian ,

thanks again. I to test with your example and work ok. :)

But , how you know it Works with this format ? :) I would like know too for the another rulers.

@ IBAM for you are ready ok ?

Thanks.

Hello cristianodias,

I assume the "complex" rules expect a more or less official/standardized format.

IBANs (at least for the supported countries) are correctly detected (with or without embedded blanks) in txt, xls(x), ods and pdf (these I have tested). 

Christian

Hi  Christian ,

thanks.

the finaly question.

what the best practice for apply the rules ??

witch is more better :

One rule of  content with all types. For example:

rule content1

IBAM , EMAIL , POSTAL CODE , etc.

Or is more better to créate one rule by types:

rule ibam

rule email

Thanks.

Hello cristianodias,

there's no best practice - you have to create them correctly: You might not yet have noticed but it's Rule 1 OR Rule 2, and within a rule CCL1 AND CCL2.

Christian

Hi Christian ,

Look this example:

I have the Rule 1 and within this rule i have

CCL1 - IBAM 

CCL2 - Postal Code

The rule 1 only active if my document content information IBAM and Posta Code ??  The AND is one logical operation ? :)

Thanks son much ,

Hello cristianodias,

correct, both CCLs must match for the rule to trigger, and yes, it's a logical AND. Please note that rules might have different destinations and/or actions (allow/acceptance/block) - IIRC the most restrictive wins.

Christian

Hi Christian ,

Great !!

Thanks so much.