How do I define phrases for custom dictionaries?


How do I define phrases for custom dictionaries?

Defining phrases for custom dictionaries is one of the tasks you must complete when adding custom dictionaries. See How do I add a custom DLP Dictionary? for a full list of tasks. 

About Phrases

You can add to your custom dictionaries phrases that represent content you want to protect for your organization. General guidelines for phrases include the following:

  • A dictionary can contain up to 120 phrases.
  • Each phrase can have a maximum of 128 characters.
  • The dictionary phrase-matching is not case-sensitive and ignore punctuations.
  • The dictionary counts all matching phrases, including identical phrases.
  • You can place quotes around phrases to specify that the dictionary detect only phrases that exactly match the phrase in the order given within the quotes.

The Zscaler service uses fuzzy matching techniques to ensure that phrases do not go undetected by dictionaries because of capitalization or spacing discrepancies and the existence of noise words (such as spurious words or HTML tags) between words. For instance, the configured phrase “security service” would match the text “security <b>service</b>”. 

Sometimes this fuzzy matching results in matching phrases from an irrelevant context and can cause false positives. In such cases, quotes or double quotes can be placed around the words of a phrase to disable fuzzy matching and match only the phrase within the quotes. Zscaler then ignores the different types of whitespace between the words. For instance, “security service” will match “security-service,” “security,service,” and other such unrelated phrases. 

Adding Phrases

To add phrase(s):

  1. Go to Administration > DLP Dictionaries & Engines.
  2. In the DLP Dictionaries tab, click Add DLP Dictionary OR edit an existing dictionary.
  3. Enter phrase(s) you want the dictionary to match when scanning content (see guidelines for phrases above). Note that you can enter phrases one by one, or you can bulk-load phrases by copying and pasting into the field. If you're bulk-loading phrases, ensure that each phrase is on a different line when you copy and paste. The dictionary will count all words on a single line as one phrase.
  4. Click for more on bulk-loading phrases.
  5. For the phrase, specify the Action the dictionary takes upon detecting a valid match. Select one of the following options from the dropdown menu:
    • Ignore: The dictionary ignores matches of the phrase. The Ignore action is for testing purposes; no action is taken if the phrase is detected, but occurrences of the phrase are recorded for your analysis in the logs for DLP.
    • Count: The dictionary counts each match of the phrase toward the Number of Violations threshold. (For example, consider a custom dictionary for which the phrase "Confidential Information" has been defined, and Count as the specified action for the pattern. If the content this dictionary scans contains three instances of the phrase "Confidential Information," all three instances would count as three matches.)
    • Trigger: The dictionary immediately triggers upon a match of the phrase.
  6. To add another phrase, select the Add Phrase icon, as shown below.

Screenshot of Phrase section in Zscaler’s DLP Dictionaries & Engines page

  1. Click Save and activate the change.

 When copying and pasting phrases, there should only be one phrase per line.

Screenshot of Add DLP Dictionary section with Phrase and Action columns