Exercise 4: Configure Data Loss Prevention (DLP) rules with custom content detectors

Exercise directions

Part 1: Create a custom detector for high-profile customers

Step 1

If you are not already signed in, sign in to your domain as the Administrator at admin.google.com.

Step 2

From the main menu, navigate to Security, then select Access and data control, and click Data protection.

Step 3

In the secondary navigation or dashboard, select the Manage custom detectors tab (or click the Manage Detectors button in the Custom detectors section). 

Step 4

Click the ADD CUSTOM DETECTOR button and select Regular expression from the dropdown menu.

Step 5

In the Name text box, enter High profile customers. In the Regular expression text box, enter the following regular expression: (?i)(\W|^)(acme\scorp|beta\sindustries|gamma\sgroup)(\W|$).

Step 6

Click the TEST EXPRESSION button to test out the expression. Enter the phrases Acme Corp, Beta Industries, or Gamma Group to check for a match.

Step 7

Click CREATE. 

-- --

Part 2: Create a DLP rule to prevent external sharing

Step 1

From the main menu, navigate to Security, then select Access and data control, and click Data protection.

Step 2

In the Rules section, click MANAGE RULES. 

Step 3

Click ADD RULE and then select New rule. 

Step 4

Enter Customer data as the name for the rule.

Step 5

In the Scope section, choose All in <yourdomain>.

Step 6

Click CONTINUE. 

Step 7

In the Apps section, check the box next to Drive and Chat (Message sent). Leave all of the actions under Select when this action should apply checked.

Step 8

Click CONTINUE. 

Step 9

To add the custom content detector you just created, from the Conditions section, click ADD CONDITION and select the following values:

• What to scan for: Matches custom detector

• Detector: High profile customers

• Minimum match count: 1

Step 10

To add the remaining conditions, in the Conditions section, click ADD CONDITION, and select the following values:

• Content type to scan: All content

• What to scan for: Matches predefined data type (recommended)

• Select data type: Global - Person name

• Likelihood Threshold: Very high

• Minimum unique matches: 1

• Minimum match count: 1

Repeat this step for the Global - Credit card number, Global - Date of Birth, and Global - Email address data types. Keep all other values the same.

Step 11

Click CONTINUE. 

Step 12

In the Actions section, under Chat, select Warn users. 

Step 13

Under the User message section that appears, check the box next to Customize message, and enter the following message:

The file you are trying to share contains sensitive information. Sharing this file violates company policy and will be flagged as a violation. Please contact Alex B at alex.b@yourdomain for additional assistance.

Step 14

Under Drive, select Block external sharing from the dropdown menu.

Step 15

Under Alerting, choose the severity level High. 

Step 16

Toggle Send to alert center to ON.

Step 17

Click the Add email recipients box. Search for Alex B, and add him to the text box. Then click DONE.

Step 18

Click CONTINUE.

Step 19

Review the rules on the Review page, and click CREATE. You should now see the new rule in the Data protection rules list.