topic Re: How to configure Data Filtering Policy in General Topics

How to configure Data Filtering Policy

hcao — Fri, 08 Jan 2010 02:23:57 GMT

I would like to know if there's a specific document that walks you through step-by-step of setting up data filtering. I am running PA2020 v3.05.

I've read the Admin Guide v3.0, but it's very vague. There's no information as to what weight # should be used or regular expression samples.

Thanks

Re: How to configure Data Filtering Policy

hcao — Fri, 08 Jan 2010 19:51:21 GMT

I've found this document and it's explained in more detailed than the Admin Guide.

https://live.paloaltonetworks.com/docs/DOC-1048

Re: How to configure Data Filtering Policy

nrice — Fri, 08 Jan 2010 20:05:18 GMT

The article you found is the most complete guide to data filtering. One caveat - the data must be a minimum of 7 bytes. I've updated the article to reflect that.

Re: How to configure Data Filtering Policy

hcao — Fri, 08 Jan 2010 20:17:54 GMT

Thank you very much for your response.

Re: How to configure Data Filtering Policy

nrice — Mon, 11 Jan 2010 20:58:15 GMT

We don't have step-by-step insructions on data filtering profiles, but you can contact Support for more information on how to create them. An example of a regular expression would be confidential or private (must be a minimum of 7 bytes). The weight is the vaule used in the calculation to determine the action to be taken when the keyword appears in session traffic. Using confidential as an example, if you weight it with 2, each time the word appears during a session the count will increment by 2. If you set up the data filtering profile to alert at 4 and block at 10, this means the word confidential appearing twice in the session will create an alert and it will be blocked if it appears 5 times.

Re: How to configure Data Filtering Policy

shabeerc — Wed, 27 Apr 2011 12:55:11 GMT

what about if just want alert not block the Data.what will be the threshold

Re: How to configure Data Filtering Policy

jpa — Wed, 27 Apr 2011 22:12:00 GMT

Set the threshold to zero to just alert and NOT block

Re: How to configure Data Filtering Policy

shabeerc — Thu, 28 Apr 2011 05:13:47 GMT

Hi J

Thanks for the info.My requirement is that i need to get alert word "confidential" in document appears 2 times but no need to block that file.So ishould configure alert threshold 4 and leave the block threshold empty.Please correct my configuration.

Thanks

Shabeer

Re: How to configure Data Filtering Policy

BLepenik — Thu, 29 Sep 2011 09:23:17 GMT

Hi,

one of our customers send us a question about the max. length of regular expression in Data Filtering Policy.

I just fimd an info that the minimum is 7 bytes but there are no data about the max. length.

Can you please help me ?

With best regards,

Bojan Lepenik

Re: How to configure Data Filtering Policy

bpappas — Thu, 29 Sep 2011 20:29:45 GMT

@lancom:

on the data pattern window "max 1024" characters.

see screengrab attached to this post:

-Benjamin