Cisco Cisco Email Security Appliance C160 Mode D'Emploi
16-18
Cisco AsyncOS 8.5 for Email User Guide
Chapter 16 Data Loss Prevention
DLP Policies for RSA Email DLP
•
Weight. For each custom rule you create, you specify a “weight” to indicate the importance of the
rule. A score is obtained by multiplying the number of detection rule matches by the weight of the
rule. Two instances of a rule with a weight of
rule. A score is obtained by multiplying the number of detection rule matches by the weight of the
rule. Two instances of a rule with a weight of
10
results in a score of
20
. If one rule is more important
for the classifier than the others, it should be assigned a greater weight.
•
Maximum Score. A rule’s maximum score prevents a large number of matches for a low-weight
rule from skewing the final score of the scan.
rule from skewing the final score of the scan.
To calculate the risk factor, the classifier multiplies the number of matches for a detection rule by the
weight of the rule. If this value exceeds the detection rule’s maximum score, the classifier uses the
maximum score value. If the classifier has more than one detection rule, it adds the scores for all of its
detection rules into a single value. The classifier maps the detection rules score (10 - 10000) on a scale
of 10 -100 using the logarithmic scale shown in the following table to create the risk factor:
weight of the rule. If this value exceeds the detection rule’s maximum score, the classifier uses the
maximum score value. If the classifier has more than one detection rule, it adds the scores for all of its
detection rules into a single value. The classifier maps the detection rules score (10 - 10000) on a scale
of 10 -100 using the logarithmic scale shown in the following table to create the risk factor:
Viewing the Policies in Which Custom Content Classifiers are Used
Procedure
Step 1
Select Mail Policies > DLP Policy Customizations.
Step 2
In the Custom Classifiers section, click the Policies link in the heading of the Custom Classifiers table.
Related Topics
•
Filtering Messages for DLP Policies
To improve performance or accuracy, you can limit a DLP policy to apply only to certain messages based
on the following criteria:
on the following criteria:
Table 16-1
How Risk Factor Scores Are Calculated From Detection Rule Scores
Rule Scores
Risk Factor
10
10
20
20
30
30
50
40
100
50
150
60
300
70
500
80
1000
90
10000
100