> For the complete documentation index, see [llms.txt](https://eaclouddoc.eauditor.eu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://eaclouddoc.eauditor.eu/eacloud-docs-en/features/data-loss-prevention-1/dlp-policies-and-rules/actions/document-labeling.md).
# Document Labeling
{% hint style="info" %}
**\[Document labeling]** We are working on this feature. We will announce its deployment in the changelog as soon as it is made available.
{% endhint %}
Document labeling using **Fingerprint** is the process of automatically assigning invisible tags to files according to predefined rules. These tags do not affect the file structure or its integrity—they follow it in the NTFS data stream, which makes them resistant to movement, copying, or editing.
## Introduction
### Key features of Fingerprint
1. **No impact on the file structure:**
* The tag does not change the file checksum.
* A file with an electronic signature remains intact.
2. **Invisible to the end user:**
* The tag is a string in the NTFS data stream.
* Visible only to the eAgent system and the administrator in the eAuditor system console.
* One file can have multiple tags.
3. **Identification in system logs:**
* The administrator sees the name of the tag that they previously defined in the system.
* The number of tags in the system is unlimited.
{% hint style="warning" %}
**Note:** Implementing a policy that classifies files should be accompanied by restrictions on the use of the file storage system in the organization, such as NTFS. If a file with a tag is moved to an environment with a different file system (e.g., FAT32), the tag will be lost.
This is especially important in situations where files are copied between devices not via network locations, for example, but using USB flash drives.
* If the USB flash drive uses the **NTFS file system, the file will be moved together with the tag.**
* If the USB flash drive uses the **FAT32 system, the moved file will lose the tag.**
{% endhint %}
### Use cases
#### 1. Tagging based on file content
* **Example:** The administrator creates a DLP policy that assigns a tag to every file containing the surname "Nowak" (case-insensitive).
* **Configuration:**
* Criterion: File content contains "Nowak".
* Tag name: "File containing the manager's surname".
* **Action:** Every file that meets the condition will be automatically marked with a string in the NTFS stream, for example `67asudhasd7a8s9diajsdhua7sd8aisddjausd8a`. The administrator will see the following information in the logs: "File ABCD.doc met the criteria and received the tag: File containing the manager's surname".
#### 2. Tagging based on location
* **Example:** The administrator assigns a tag to files saved in the "Downloads" folder.
* **Configuration:**
* Criterion: File location `C:\Users\Downloads`.
* Tag name: "Downloaded file".
* **Action:** Every file saved in the "Downloads" folder is automatically assigned a tag.
#### 3. Tagging based on process
* **Example:** Files created by the `aplikacjatest.exe` process are to be tagged.
* **Configuration:**
* Criterion: Process `aplikacjatest.exe`.
* Tag name: "File from test application".
* **Action:** Every file created by the specified process, regardless of its extension and location, receives a tag.
#### 4. Combining rules and tags
Rules can be applied simultaneously and overlap, for example, files containing "Nowak" saved in the "Downloads" folder can receive an additional tag.
### Benefits and advanced use cases
#### 1. **Log filtering and reporting**
Tags make it easy to filter logs in the system, which allows the administrator to find all files that meet specific criteria (e.g., content, location, process) by searching for the tag name. Reports can also be generated with information about:
* File location.
* Author (who created the file).
* File creation date.
#### 2. **Monitoring operations on tagged files**
**Example:** The "File operations" policy monitors changes to the name of a file tagged as "File containing the manager's surname".
* Configuration: Define monitoring of name changes for files with a given tag.
* Effect: Every attempt to rename a file is logged in the system, and the operation can also be blocked.
#### 3. **Blocking file editing**
**Example:** Blocking editing of files tagged as "File from test application".
* Configuration: The policy blocks saving a file with a given tag.
* Effect: The user cannot edit or save changes to the file.
## Configuration
System **eAuditor** allows tags to be assigned **Fingerprint** in two ways:
1. **Using a schedule:**
* Files are classified periodically, at specified time intervals.
* The system, through the agent, scans the specified locations and marks files that meet the defined criteria.
* Configuration is performed in the second step (we skip the first one)
2. **Using the File Operation rule:**
* Files are classified dynamically at the moment of save or creation.
* Every file meeting the specified parameters will be automatically tagged during the operation.
{% hint style="warning" %}
#### Entering multiple parameters in one rule
Within a single rule, multiple parameters can be entered (e.g., domain masks, paths, file names, or processes). There is no need to create a separate rule for each one.
Each parameter should be entered **on a separate line**, separating successive entries only with the **ENTER**key. Commas, semicolons, or other separators should not be used.
In this case, the **OR**logic applies. This means that the rule will be applied if **any** of the specified conditions is met.
**Example - paths**
```
C:\Users\Public\
D:\Documents\
*\Server\Share\*
```
The rule will be applied if the operation involves **any** of the specified paths.
**Example - file names**
```
*.pdf
*.docx
*.xlsx
```
The rule will be applied to **any** PDF, DOCX, or XLSX file.
{% endhint %}
***
### Configuration using a schedule
Configuration steps
{% stepper %}
{% step %}
#### Create a policy or add a rule
* Go to the main DLP policies view.
* Create a new policy or edit an existing one.
{% endstep %}
{% step %}
#### Add action
Select action **Add tag** or **Remove tag**:
* **Add tag:** File tagging.
* **Remove tag:** Removing existing tags is the only option for deleting a tag by the administrator.
{% endstep %}
{% step %}
#### Configure locations and files
Specify the location mask, for example:
* `C:\Users\Documents` — monitoring the "Documents" folder.
* The ability to specify exclusions for selected subfolders.
[How do you add/edit a mask?](/eacloud-docs-en/features/data-loss-prevention-1/dlp-policies-and-rules/triggers/file-operations/masks.md)
Specify the file mask, for example:
* `*.docx` — monitoring Word documents.
* The ability to specify exclusions (e.g. `test.docx`).
[How do you add/edit a mask?](/eacloud-docs-en/features/data-loss-prevention-1/dlp-policies-and-rules/triggers/file-operations/masks.md)
{% endstep %}
{% step %}
#### Enter credentials
* Provide the credentials required by the agent to access the scanned location (e.g., a dedicated domain account with appropriate permissions).
* Select the **Read-only files** option (if applicable).
{% endstep %}
{% step %}
### Scanning interval
Define the interval at which the specified locations will be scanned to classify files that meet the specified parameters.
{% endstep %}
{% step %}
#### Select tag
Select a tag from the list of available tags:
* Adding new tags is described in the section [**Adding a new tag**](#dodawanie-nowego-znacznika).
{% endstep %}
{% step %}
#### Add content search pattern (optional)
* Select file content search criteria:
* **Content contains:** Search for files containing specified text.
* **Content does not contain:** Search for files without specified text.
* Supported file masks: `*.docx`, `*.xlsx`, `*.pptx`, `*.txt`.
* Adding new patterns is described in the section [**Adding a content search pattern**](#dodawanie-wzorca-przeszukiwania-tresci).
{% endstep %}
{% step %}
#### Save configuration
{% endstep %}
{% step %}
#### Add notifications (optional)
Possible notification options:
* **Log for the administrator.**
* **E-mail for the administrator.**
* **Message for the user.**
{% endstep %}
{% endstepper %}
{% hint style="info" %}
**INFO:** Notifications for tags are not recommended due to the large number of operations, which may lead to an excess of logs and messages.
{% endhint %}
### Configuration using the File Operation rule
Configuration steps
{% stepper %}
{% step %}
#### Create a policy or add a rule
* Go to the main DLP policies view.
* Create a new policy or edit an existing one
{% endstep %}
{% step %}
#### Add trigger
* In the field **"When this happens..."** add a new step and select the trigger **File operation**.
* Adding or removing a tag is available for the following operation types:
* **Save.**
* **Create.**
{% hint style="warning" %}
**WARNING!** If you select other operation types, the file classification option will be unavailable.
{% endhint %}
{% endstep %}
{% step %}
#### Define file parameters
Specify classification criteria:
* File location.
* File extension.
* More information about parameters in the section [**File operations**](/eacloud-docs-en/features/data-loss-prevention-1/dlp-policies-and-rules/triggers/file-operations.md).
{% endstep %}
{% step %}
#### Add action
Select action **Add tag** or **Remove tag**.
{% endstep %}
{% step %}
#### Select tag
Select a tag from the list of available tags:
* Initially, the list contains two sample tags.
"Why can't I see tags?" - [**Adding a new tag**](#dodawanie-nowego-znacznika).
{% endstep %}
{% step %}
#### Add content search pattern (optional)
* Select file content search criteria:
* **Content contains:** Search for files containing specified text.
* **Content does not contain:** Search for files without specified text.
* Supported file masks: `*.docx`, `*.xlsx`, `*.pptx`, `*.txt`.
**"Why can't I see content search patterns?" -** [**Adding a content search pattern**](#dodawanie-wzorca-przeszukiwania-tresci).
{% endstep %}
{% step %}
#### Save configuration
{% endstep %}
{% step %}
#### Add notifications (optional)
Possible notification options:
* **Alert for the administrator.**
* **E-mail for the administrator.**
* **Message for the user.**
* **Alert for the user.**
{% endstep %}
{% endstepper %}
{% hint style="info" %}
**INFO:** Notifications for tags are not recommended due to the large number of operations.
{% endhint %}
### Adding a new tag
Below you will find instructions that will be useful if you have reached step 7 [configuration using a schedule](#konfiguracja-za-pomoca-harmonogramu) or 6 [File operation rule](#konfiguracja-za-pomoca-reguly-operacja-na-plikach).
{% stepper %}
{% step %}
#### Click **+ Add new tag**.
{% endstep %}
{% step %}
#### Enter
* Tag name.
* Description (optional).
{% endstep %}
{% step %}
#### Save tag.
{% endstep %}
{% endstepper %}
The new tag will be added to the list and will be available when creating classification rules.
### Adding a content search pattern
Below you will find instructions that will be useful if you have reached step 6 [configuration using a schedule](#konfiguracja-za-pomoca-harmonogramu) or 5 [File operation rule](#konfiguracja-za-pomoca-reguly-operacja-na-plikach).
{% hint style="warning" %}
**WARNING!** The file content search parameter is supported only for the following file masks: \*.docx, \*.xlsx, \*pptx, \*.txt
{% endhint %}
{% stepper %}
{% step %}
#### Click **Define a new tag pattern**.
{% endstep %}
{% step %}
#### Enter
* Pattern name.
* Description (optional).
{% endstep %}
{% step %}
#### Select pattern type
**Text (string):**
* Simple text that the system will search for in the file.
* Example:
* `"Kowalski"` — if the word "Kowalski" appears in the file content, the file will be marked as meeting the conditions.
* Enter the text one by one, without commas, separating them using ENTER.
[**Regular expression (RegEx)**](/eacloud-docs-en/features/data-loss-prevention-1/dlp-policies-and-rules/actions/document-labeling/regular-expressions.md)**:**
* An advanced way to define a pattern that allows you to search for more complex data structures in files.
* Examples:
* **PESEL**: `\b[0-9]{11}\b` — searches for an 11-digit PESEL number.
* **E-mail**: `[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}` — searches for e-mail addresses.
* **Phone number**: `\b\d{3}[-.\s]?\d{3}[-.\s]?\d{3}\b` — searches for phone numbers in the 123-456-789 format.
* **IP address (IPv4):** `\b((25[0-5]|2[0-4][0-9]|[0-1]?[0-9][0-9]?).){3}(25[0-5]|2[0-4][0-9]|[0-1]?[0-9][0-9]?)\b` - Searches for IPv4 addresses, for example `192.168.1.1`.
* **Credit card number (16 digits):** `\b(?:\d[ -]*?){13,16}\b` — Searches for credit card numbers, for example `1234-5678-1234-5678`.
* **Postal code in Polish format (XX-XXX):** `\b\d{2}-\d{3}\b` — Searches for postal codes in Poland, for example `01-234`.
{% endstep %}
{% endstepper %}
The pattern added this way will be added to the list of patterns available when creating classification rules.
{% hint style="warning" %}
**WARNING!**
* The example patterns provided are for demonstration purposes only and are not subject to validation.
* The administrator should test and adjust the patterns to the requirements of their organization.
{% endhint %}
### Summary
Document labeling using **Fingerprint** is an advanced and flexible tool supporting the enforcement of security policies in the organization. Thanks to precise file tagging, the administrator gains full control over monitoring and managing documents, regardless of their location, content, or source. Practical applications can be found in the section **Case Study**, which discusses scenarios for using this feature in detail.
{% hint style="info" %}
**\[Document labeling]** We are working on this feature. We will announce its deployment in the changelog as soon as it is made available.
{% endhint %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://eaclouddoc.eauditor.eu/eacloud-docs-en/features/data-loss-prevention-1/dlp-policies-and-rules/actions/document-labeling.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
