Important Update: Cohesity Products Documentation
All Cohesity product documentation are now managed via the Cohesity Docs Portal: https://docs.cohesity.com/HomePage/Content/home.htm. Some documentation available here may not reflect the latest information or may no longer be accessible.
Arctera™ Insight Classification Help
- What's New
- Known Issues
- Getting Started
- Policies
- About policies
- About built-in classification policies
- Creating policies
- About policy conditions
- Using a keywords-based exclusion policy condition
- Regular expression syntax
- Enabling or disabling policies
- Editing policies
- Exporting or importing policies
- Resetting policies
- Deleting policies
- Transparent policies
- Creating a customized copy of transparent policies
- Microsoft Information Protection (MIP) Labels
- Patterns
- Tags
- Analyze
- Audit
Using a keywords-based exclusion policy condition
To use a keywords-based exclusion policy condition
- Click the Exclude Match check box.
The new input field for defining exclusion terms is displayed.
- In the inclusion terms field, enter the keywords, phrases, or regular expression that you want to include while evaluating the policy condition criteria. In the exclusion terms field, define the keywords or phrases that you want to exclude while evaluating the policy condition criteria.
Note:
Use only single word, phrase, or regular expression per line in both the fields as shown in the sample image below.
For more information about supported types of regular expression syntax, See Regular expression syntax.
- If required, select the Match Case and/or String Match check boxes for both input fields.
- Specify the minimum count value in the last input field that applies to the number of matches in the document, and not to the number of excluded matches.
Below is a scenario to understand the concept in detail.
Test data - ""
If you do not use the option, the application provides a hit on spoofing and spoofed (two occurrences).
However, if you use the option, let's understand how the terms get excluded.
: The first hit which is on spoofing. The application looks in both the directions (forward and backward) by 22 characters proximity. Application can not find any exclusion term, therefore, the term spoofing will be a match.
: The next hit will be the term spoofed. The application looks for exclusion terms in both the directions from the term spoofed by 22 characters proximity. Application can not find any exclusion term, therefore, the term spoofed will be a match.
: The next hit will again be the term spoofed. The application looks for exclusion terms in both directions from the term spoofed by 22 characters proximity. The application finds an exclusion term spoofed email account in the forward direction. Therefore, application ignores the term and do not consider it as a match.
In the section, you get only one match for the term spoofing and another match for the term spoofed terms. However, the match for the terms spoofed email account is excluded. The match result appears as shown in the sample image below:
