CCE Rule Examples
Note: Allowed paths defined for a metadata do not prevent CCE classification from applying that metadata.
How to identify files based on size containing U.S Social Security Numbers
Criteria:
- Files under 5MB
- Set Metadata PII.Level = "HIGH" if there is a pattern match or as PII.Level = "LOW"
Pre-Requisite:
- Have Metadata set PII defined with Level attribute
- Have Pattern defined with the name "US Social Security Number"
{
"classifier": "Default",
"precondition": "_file.size < 5000000",
"condition": "count(_classifications) > 0",
"matchaction": {
"PII": {
"Level": "HIGH"
}
},
"defaultaction": {
"PII": {
"Level": "LOW"
}
},
"parameters": {
"SEARCH_PATTERN_NAMES": [
"US Social Security Number"
]
}
}
How to identify files based on extensions and containing US Social Security Numbers
Criteria:
- Apply to files with extensions .txt & .pdf
- Set Metadata PII.Level = "HIGH" if there is a pattern match or as PII.Level = "LOW"
Pre-Requisite:
- Have Metadata set PII defined with Level attribute
- Have RegExp pattern for US Social Security Numbers
{
"classifier": "Default",
"precondition": "_file.ext in ['txt', 'pdf']",
"condition": "count(_classifications) > 0",
"matchaction": {
"PII": {
"Level": "HIGH"
}
},
"defaultaction": {
"PII": {
"Level": "LOW"
}
},
"parameters": {
"SEARCH_PATTERN_SET": [
"/[0-9]{9}/"
]
}
}
How to identify files containing US Social Security Numbers
Criteria:
- Apply to all files
- Set Metadata PII.Level = "HIGH" if there is a pattern match or as PII.Level = "LOW"
Pre-Requisite:
- Have Metadata set PII defined with Level attribute
- Have Pattern defined with the name "US Social Security Numbers"
{
"classifier": "Default",
"precondition": "true",
"condition": "count(_classifications) > 0",
"matchaction": {
"PII": {
"Level": "HIGH"
}
},
"defaultaction": {
"PII": {
"Level": "LOW"
}
},
"parameters": {
"SEARCH_PATTERN_NAMES": [
"US Social Security Number"
]
}
}
How to identify files containing one of the patterns in the pattern group
Criteria:
- Apply to all files
- Set Metadata PII.Level = "HIGH" if there is a pattern match or as PII.Level = "LOW"
Pre-Requisite:
- Have Metadata set PII defined with Level attribute
- Have Pattern Group - GDPR defined
{
"classifier": "Default",
"precondition": "true",
"condition": "count(_classifications) > 0",
"matchaction": {
"GDPR": {
"Level": "HIGH"
}
},
"defaultaction": {
"GDPR": {
"Level": "LOW"
}
},
"parameters": {
"SEARCH_PATTERN_GROUPS": [
"GDPR"
]
}
}
How to identify files containing US Social Security Numbers inside the user folder /my.user/PII/
Criteria:
- Apply to all files inside
/my.user/PII/ - Set Metadata PII.Level = "HIGH" if there is a pattern match or as PII.Level = "LOW"
Pre-Requisite:
- Have Metadata set PII defined with Level attribute
- Have Pattern defined with the name "US Social Security Number"
{
"classifier": "Default",
"precondition": "starts_with(_file.fullPath, '/my.user/PII/')",
"condition": "count(_classifications) > 0",
"matchaction": {
"PII": {
"Level": "HIGH"
}
},
"defaultaction": {
"PII": {
"Level": "LOW"
}
},
"parameters": {
"SEARCH_PATTERN_NAMES": [
"US Social Security Number"
]
}
How to identify files containing white spaces within words or sentences
Criteria:
- Apply to text and pdf files
- Set Metadata PII.Level = "HIGH" if there is a pattern match or as PII.Level = "LOW" otherwise
Pre-Requisite:
- Have Metadata set PII defined with Level attribute.
{
"classifier": "Default",
"precondition": "_file.ext in ['txt', 'pdf']",
"condition": "count(_classifications) > 0",
"matchaction": {
"PII": {
"Level": "HIGH"
}
},
"defaultaction": {
"PII": {
"Level": "LOW"
}
},
"parameters": {
"SEARCH_PATTERN_SET": [
"\/[0-9]{4} [0-9]{4} [0-9]{4} [0-9]{4}\/"
]
}
}
How to identify files containing Singapore National Registry Identity Card (NRIC)
Criteria:
- Apply to all files
- Set metadata NRIC.Confidentialilty Level = "HIGH" if there is a pattern match or NRIC.Confidentiality Level = "LOW"
Pre-Requisite:
- Have metadata set NRIC defined with Confidentiality Level attribute
{
"classifier": "SingaporeNRIC",
"precondition": "true",
"condition": "count(_classifications) > 0",
"matchaction": {
"NRIC": {
"Confidentiality Level": "HIGH"
}
},
"defaultaction": {
"NRIC": {
"Confidentiality Level": "LOW"
}
},
"parameters": []
}
}