Content Rules

Learn how Content Rules work in Transfer Shield DLP

Introduction

Content Rules define the content or file types that Transfer Shield should allow or block.

Every Content Rule belongs to a Content Rule Group. A group can contain one or more rules.

Rule types

A Content Rule can use one of two rule types:

Rule type	Description
Block matching files	Blocks files that match the rule
Allow only matching files	Allows only files that match the rule

Files can be matched using detected content, MIME type, or both.

Content classification

Content Rules can match detected content classifications including:

• Emails
• Phone numbers
• Banking information
• Payment card information
• ID cards
• Government documents
• Driver licenses
• Social Security numbers
• Passports
• UUIDs
• Personal information
• Malware

MIME type classification

Content Rules can also match files based on MIME type.

This can be used to allow or block file types such as:

• Images
• PDFs
• Documents
• Spreadsheets
• Executables
• Binary files

How Content Rules are evaluated

Within a Content Rule, selected content classifications are evaluated as OR.

For example:

Passport OR Driver License

Selected MIME types are also evaluated as OR.

For example:

JPEG OR PNG OR PDF

When content classifications and MIME types are configured in the same rule, the two sets are evaluated together as AND.

For example, a rule configured with:

• Passport
• Driver License

and:

• JPEG
• PNG
• PDF

matches:

(Passport OR Driver License) AND (JPEG OR PNG OR PDF)

The file therefore needs to match at least one selected content classification and at least one selected MIME type.

How multiple rules are evaluated

A Content Rule Group can contain multiple Content Rules.

Rules within the same Content Rule Group are evaluated as OR.

If any Content Rule matches, the Content Rule Group matches.