Creating Custom DLP Classification Rules and Policy

When at first I was looking into this the TechNet documentation was extensive and yet not as specific as I would prefer, so here is the quick and dirty DLP classification!

Creating and importing custom Classifications

1. First you need to create your custom policy XML (Example Below)
2. Save as XML Unicode file type (C:\MyNewPolicy.xml)
3. Open the XML in internet explorer if its formatted correctly you will see the XML.
4. Then import with Powershell
   New-ClassificationRuleCollection –FileData ([Byte[]]$(Get-Content -path C:\MyNewPolicy.xml -Encoding byte -ReadCount 0))
5. Once its imported you should be able to create a new DLP policy using the EAC

Creating a custom DLP Rule

1. Login to EAC (i.e https://mail.domain.com/ecp)
2. Click Compliance Management, data loss prevention
3. Click the Plus , then New custom policy
   
4. Name your policy and Choose your mode (I like to test with Policy tags), and click Save
   
5. Select the policy and click the edit your new policy
6. Select Rules from the left
7. Click the to Create a new rule
8. On the Apply this rule if field choose The message contains Sensitive information..
9. Click *Select sensitive information types….. (if applicable)
10. Click the to choose from the list,
11. You should now see your new classification (from the example below it would be Secure Product Codes\ DLP by Exchangemasters.info)

Useful Tools

• Regex – http://gskinner.com/RegExr/
• GUID creator – http://www.guidgenerator.com/online-guid-generator.aspx
• Technet – http://technet.microsoft.com/en-us/library/jj674704(v=exchg.150).aspx

Example of a Rule Classification XML

 <?xml version=”1.0″ encoding=”utf-16″?>

 <RulePackage xmlns=”http://schemas.microsoft.com/office/2011/mce”&gt;

 <RulePack id=”b4b4c60e-2ff7-47b2-a672-86e36cf608be”>

  <Version major=”1″ minor=”0″ build=”0″ revision=”0″/>

  <Publisher id=”7ea13c35-0e58-472a-b864-5f2e717edec6″/>

  <Details defaultLangCode=”en-us”>

  <LocalizedDetails langcode=”en-us”>

  <PublisherName>DLP by Exchangemasters.info</PublisherName>

  <Name>Secure Product Codes</Name>

  <Description>Secure Products</Description>

  </LocalizedDetails>

  </Details>

  </RulePack>

  <Rules>

  <!– Product Code –>

  <Entity id=”acc59528-ff01-433e-aeee-13ca8aaee159″ patternsProximity=”300″ recommendedConfidence=”75″>

 <Pattern confidenceLevel=”75″>

  <IdMatch idRef=”Regex_Product_Code” />

  <Match idRef=”Code” />

  </Pattern>

  </Entity>

  <Regex id=”Regex_Product_Code”>[A-Z]{3}[0-9]{9}

  </Regex>

  <Keyword id=”Code”>

  <Group matchStyle=”word”>

  <Term>Code</Term>

  </Group>

  </Keyword>

  <LocalizedStrings>

  <Resource idRef=”acc59528-ff01-433e-aeee-13ca8aaee159″>

  <Name default=”true” langcode=”en-us”>

  Product Code

  </Name>

  <Description default=”true” langcode=”en-us”>

 A custom classification for detecting product codes that have 3 uppercase letters and 9 numbers

 </Description>

 </Resource>

</LocalizedStrings>

</Rules>

</RulePackage>