Document Labeling

[Document labeling] We are working on this feature. We will announce its deployment in the changelog as soon as it is made available.

Document labeling using Fingerprint is the process of automatically assigning invisible tags to files according to predefined rules. These tags do not affect the file structure or its integrity—they follow it in the NTFS data stream, which makes them resistant to movement, copying, or editing.

Introduction

Key features of Fingerprint

1. No impact on the file structure:

   • The tag does not change the file checksum.

   • A file with an electronic signature remains intact.

2. Invisible to the end user:

   • The tag is a string in the NTFS data stream.

   • Visible only to the eAgent system and the administrator in the eAuditor system console.

   • One file can have multiple tags.

3. Identification in system logs:

   • The administrator sees the name of the tag that they previously defined in the system.

   • The number of tags in the system is unlimited.

Note: Implementing a policy that classifies files should be accompanied by restrictions on the use of the file storage system in the organization, such as NTFS. If a file with a tag is moved to an environment with a different file system (e.g., FAT32), the tag will be lost.

This is especially important in situations where files are copied between devices not via network locations, for example, but using USB flash drives.

• If the USB flash drive uses the NTFS file system, the file will be moved together with the tag.

• If the USB flash drive uses the FAT32 system, the moved file will lose the tag.

Use cases

1. Tagging based on file content

• Example: The administrator creates a DLP policy that assigns a tag to every file containing the surname "Nowak" (case-insensitive).

• Configuration:

  • Criterion: File content contains "Nowak".

  • Tag name: "File containing the manager's surname".

• Action: Every file that meets the condition will be automatically marked with a string in the NTFS stream, for example 67asudhasd7a8s9diajsdhua7sd8aisddjausd8a. The administrator will see the following information in the logs: "File ABCD.doc met the criteria and received the tag: File containing the manager's surname".

2. Tagging based on location

• Example: The administrator assigns a tag to files saved in the "Downloads" folder.

• Configuration:

  • Criterion: File location C:\Users\Downloads.

  • Tag name: "Downloaded file".

• Action: Every file saved in the "Downloads" folder is automatically assigned a tag.

3. Tagging based on process

• Example: Files created by the aplikacjatest.exe process are to be tagged.

• Configuration:

  • Criterion: Process aplikacjatest.exe.

  • Tag name: "File from test application".

• Action: Every file created by the specified process, regardless of its extension and location, receives a tag.

4. Combining rules and tags

Rules can be applied simultaneously and overlap, for example, files containing "Nowak" saved in the "Downloads" folder can receive an additional tag.

Benefits and advanced use cases

1. Log filtering and reporting

Tags make it easy to filter logs in the system, which allows the administrator to find all files that meet specific criteria (e.g., content, location, process) by searching for the tag name. Reports can also be generated with information about:

• File location.

• Author (who created the file).

• File creation date.

2. Monitoring operations on tagged files

Example: The "File operations" policy monitors changes to the name of a file tagged as "File containing the manager's surname".

• Configuration: Define monitoring of name changes for files with a given tag.

• Effect: Every attempt to rename a file is logged in the system, and the operation can also be blocked.

3. Blocking file editing

Example: Blocking editing of files tagged as "File from test application".

• Configuration: The policy blocks saving a file with a given tag.

• Effect: The user cannot edit or save changes to the file.

Configuration

System eAuditor allows tags to be assigned Fingerprint in two ways:

1. Using a schedule:

   • Files are classified periodically, at specified time intervals.

   • The system, through the agent, scans the specified locations and marks files that meet the defined criteria.

   • Configuration is performed in the second step (we skip the first one)

2. Using the File Operation rule:

   • Files are classified dynamically at the moment of save or creation.

   • Every file meeting the specified parameters will be automatically tagged during the operation.

Entering multiple parameters in one rule

Within a single rule, multiple parameters can be entered (e.g., domain masks, paths, file names, or processes). There is no need to create a separate rule for each one.

Each parameter should be entered on a separate line, separating successive entries only with the ENTERkey. Commas, semicolons, or other separators should not be used.

In this case, the ORlogic applies. This means that the rule will be applied if any of the specified conditions is met.

Example - paths

C:\Users\Public\
D:\Documents\
*\Server\Share\*

The rule will be applied if the operation involves any of the specified paths.

Example - file names

*.pdf
*.docx
*.xlsx

The rule will be applied to any PDF, DOCX, or XLSX file.

---

Configuration using a schedule

Configuration steps

1

Create a policy or add a rule

• Go to the main DLP policies view.

• Create a new policy or edit an existing one.

2

Add action

Select action Add tag or Remove tag:

• Add tag: File tagging.

• Remove tag: Removing existing tags is the only option for deleting a tag by the administrator.

3

Configure locations and files

Specify the location mask, for example:

• C:\Users\Documents — monitoring the "Documents" folder.

• The ability to specify exclusions for selected subfolders.

How do you add/edit a mask?

Specify the file mask, for example:

• *.docx — monitoring Word documents.

• The ability to specify exclusions (e.g. test.docx).

How do you add/edit a mask?

4

Enter credentials

• Provide the credentials required by the agent to access the scanned location (e.g., a dedicated domain account with appropriate permissions).

• Select the Read-only files option (if applicable).

5

Scanning interval

Define the interval at which the specified locations will be scanned to classify files that meet the specified parameters.

6

Select tag

Select a tag from the list of available tags:

• Adding new tags is described in the section Adding a new tag.

7

Add content search pattern (optional)

• Select file content search criteria:

  • Content contains: Search for files containing specified text.

  • Content does not contain: Search for files without specified text.

• Supported file masks: *.docx, *.xlsx, *.pptx, *.txt.

• Adding new patterns is described in the section Adding a content search pattern.

8

Save configuration

9

Add notifications (optional)

Possible notification options:

• Log for the administrator.

• E-mail for the administrator.

• Message for the user.

INFO: Notifications for tags are not recommended due to the large number of operations, which may lead to an excess of logs and messages.

Configuration using the File Operation rule

Configuration steps

1

Create a policy or add a rule

• Go to the main DLP policies view.

• Create a new policy or edit an existing one

2

Add trigger

• In the field "When this happens..." add a new step and select the trigger File operation.

• Adding or removing a tag is available for the following operation types:

  • Save.

  • Create.

WARNING! If you select other operation types, the file classification option will be unavailable.

3

Define file parameters

Specify classification criteria:

• File location.

• File extension.

• More information about parameters in the section File operations.

4

Add action

Select action Add tag or Remove tag.

5

Select tag

Select a tag from the list of available tags:

• Initially, the list contains two sample tags.

"Why can't I see tags?" - Adding a new tag.

6

Add content search pattern (optional)

• Select file content search criteria:

  • Content contains: Search for files containing specified text.

  • Content does not contain: Search for files without specified text.

• Supported file masks: *.docx, *.xlsx, *.pptx, *.txt.

"Why can't I see content search patterns?" - Adding a content search pattern.

7

Save configuration

8

Add notifications (optional)

Possible notification options:

• Alert for the administrator.

• E-mail for the administrator.

• Message for the user.

• Alert for the user.

INFO: Notifications for tags are not recommended due to the large number of operations.

Adding a new tag

Below you will find instructions that will be useful if you have reached step 7 configuration using a schedule or 6 File operation rule.

1

Click + Add new tag.

2

Enter

• Tag name.

• Description (optional).

3

Save tag.

The new tag will be added to the list and will be available when creating classification rules.

Adding a content search pattern

Below you will find instructions that will be useful if you have reached step 6 configuration using a schedule or 5 File operation rule.

WARNING! The file content search parameter is supported only for the following file masks: *.docx, *.xlsx, *pptx, *.txt

1

Click Define a new tag pattern.

2

Enter

• Pattern name.

• Description (optional).

3

Select pattern type

Text (string):

• Simple text that the system will search for in the file.

• Example:

  • "Kowalski" — if the word "Kowalski" appears in the file content, the file will be marked as meeting the conditions.

• Enter the text one by one, without commas, separating them using ENTER.

Regular expression (RegEx):

• An advanced way to define a pattern that allows you to search for more complex data structures in files.

• Examples:

  • PESEL: \b[0-9]{11}\b — searches for an 11-digit PESEL number.

  • E-mail: [a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,} — searches for e-mail addresses.

  • Phone number: \b\d{3}[-.\s]?\d{3}[-.\s]?\d{3}\b — searches for phone numbers in the 123-456-789 format.

  • IP address (IPv4): \b((25[0-5]|2[0-4][0-9]|[0-1]?[0-9][0-9]?).){3}(25[0-5]|2[0-4][0-9]|[0-1]?[0-9][0-9]?)\b - Searches for IPv4 addresses, for example 192.168.1.1.

  • Credit card number (16 digits): \b(?:\d[ -]*?){13,16}\b — Searches for credit card numbers, for example 1234-5678-1234-5678.

  • Postal code in Polish format (XX-XXX): \b\d{2}-\d{3}\b — Searches for postal codes in Poland, for example 01-234.

The pattern added this way will be added to the list of patterns available when creating classification rules.

WARNING!

• The example patterns provided are for demonstration purposes only and are not subject to validation.

• The administrator should test and adjust the patterns to the requirements of their organization.

Summary

Document labeling using Fingerprint is an advanced and flexible tool supporting the enforcement of security policies in the organization. Thanks to precise file tagging, the administrator gains full control over monitoring and managing documents, regardless of their location, content, or source. Practical applications can be found in the section Case Study, which discusses scenarios for using this feature in detail.

[Document labeling] We are working on this feature. We will announce its deployment in the changelog as soon as it is made available.