How to configure Data Filtering Policy

[hcao]

I would like to know if there's a specific document that walks you through step-by-step of setting up data filtering.  I am running PA2020 v3.05.

I've read the Admin Guide v3.0, but it's very vague.  There's no information as to what weight # should be used or regular expression samples.

Thanks

[hcao]

I've found this document and it's explained in more detailed than the Admin Guide.

https://live.paloaltonetworks.com/docs/DOC-1048

[nrice]

The article you found is the most complete guide to data filtering.  One caveat - the data must be a minimum of 7 bytes.  I've updated the article to reflect that.

[hcao]

Thank you very much for your response.

[nrice]

We don't have step-by-step insructions on data filtering profiles, but you can contact Support for more information on how to create them. An example of a regular expression would be confidential or private (must be a minimum of 7 bytes). The weight is the vaule used in the calculation to determine the action to be taken when the keyword appears in session traffic.  Using confidential as an example, if you weight it with 2, each time the word appears during a session the count will increment by 2.  If you set up the data filtering profile to alert at 4 and block at 10, this means the word confidential appearing twice in the session will create an alert and it will be blocked if it appears 5 times.

[shabeerc]

Hi

what about if just want alert not block the Data.what will be the threshold

[jpa]

Set the threshold to zero to just alert and NOT block

[shabeerc]

     Hi J

Thanks for the info.My requirement is that i need to get alert word "confidential" in document appears 2 times but no need to block  that file.So ishould configure alert threshold 4 and leave the block threshold empty.Please correct my configuration.

Thanks

Shabeer

[BLepenik]

Hi,

one of our customers send us a question about the max. length of regular expression in Data Filtering Policy.

I just fimd an info that the minimum is 7 bytes but there are no data about the max. length.

Can you please help me ?

With  best regards, 

Bojan Lepenik

[bpappas]

@lancom:

on the data pattern window "max 1024" characters.

see screengrab attached to this post:

-Benjamin