Masks

Configuration of path, file, and process masks.

Introduction

Configuring DLP rules in the system often requires defining locations, file types, or processes that will be covered by the security policy. Masks allow you to precisely define what is to be monitored or blocked, while exclusion masks make it possible to exclude specific elements from rule enforcement.

Examples of mask usage

• Path mask: Defines the locations covered by the rule, e.g. C:\Desktop. All files in this location, including subfolders, will be monitored unless excluded, e.g. C:\Desktop\Trash.

• File mask: Defines the type of files covered by the policy, e.g. *.txt. All text files will be covered by the rule, with the ability to exclude specific files, e.g. ABCD.TXT.

• Process mask: Defines the processes covered by the rule, e.g. *.exe. Specific processes can be excluded, such as chrome.exe.

Practical applications

1. Path mask:

   • Configuration:

     • The rule covers files in the location C:\Desktop.

     • Exclusion: C:\Desktop\Trash.

   • Effect: All files on the desktop, including subdirectories, will be monitored except those located in the "Trash" folder.

2. File mask:

   • Configuration:

     • File monitoring *.docx.

     • Exclusion: Report.docx.

   • Effect: The policy applies to all Word files in the location, except for the specified file "Report.docx".

3. Process mask:

   • Configuration:

     • Process monitoring *.exe.

     • Exclusion: chrome.exe.

   • Effect: All executable processes are monitored, except for the Chrome browser.

4. Advanced example:

   • File mask: *invoice*.*.

   • Effect: All files containing "invoice" in the name are monitored, regardless of file extension.

   • Exclusion: TESTinvoice.doc.

---

Step-by-step configuration

Creating path, file, or process masks

1

Expand the configuration field

In the main rule view, go to the mask configuration section.

2

Add a new mask

• Click + Add new next to the appropriate field.

3

Edit mask

• After confirmation, a field will open where you can change the mask name.

• Optionally, add a description to make it easier to identify the mask later.

4

Enter mask criteria

• Enter path, file, or process masks (one item per line).

• Example:

  • Paths: C:\Desktop, C:\Documents.

  • Files: *.txt, Report.docx.

  • Processes: chrome.exe, *.exe.

5

Confirm the configuration

• Click "Save" to add the mask to the list of available masks, or cancel the process with the "Cancel" button.

• The new mask will also be available as an exclusion mask option.

Wildcards

The system supports the wildcard character *, which replaces any string of characters (including an empty one). This makes it possible to create flexible masks that match many different values.

Usage examples

Web addresses

Mask	Match
*mail.onet.pl	https://mail.onet.pl, http://mail.onet.pl
*.facebook.com/*	all subpages of the Facebook domain
https://www.facebook.com/	only the exact specified address

Note: If the address may include a prefix, e.g. https://, it is recommended to start the mask with the character *. This way, the rule will match regardless of the beginning of the address.

Files

Mask	Match
*.pdf	all PDF files
*invoice*.*	all files containing the word "invoice" in the name, regardless of extension
Report.docx	only the file named Report.docx

Paths

Mask	Match
C:\Users\*	all files and directories in the folder Users
*\Desktop\*	any path containing the directory Desktop
C:\Desktop	only the specified location

Processes

Mask	Match
*.exe	all executable processes
*chrome*	all processes whose name contains the word chrome
chrome.exe	only the process chrome.exe

Recommendation: If exact matching is not required, use the character *. It allows additional characters before or after the searched value to be included, making rules more universal and resilient to differences in notation.

Example of mask usage in rules

Trigger File Operation

• File masks allow you to monitor file opening in selected processes, e.g.:

  • File monitoring *.docx in the process word.exe.

  • Blocking file opening in the process chrome.exe.

Additional information

• Recommendation for broad masks: For broad masks, it is advisable to use exclusion masks, e.g.:

  • Files: *.bin, *.cookie, *.dat, *.db, *.dll, *.exe, *.ini, *.json, *.lnk, *.nls, *.ost, *.prefs, *.sdb, *.sync, *.temp, *.tmp.

  • Paths: AppData, Program Files, Windows.

INFO: The examples are provided only as suggested usage scenarios and are not subject to vendor validation. They should be modified according to the organization's requirements.

Entering multiple parameters in a single rule

Within a single rule, you can enter multiple parameters (e.g., domain, path, file name, or process masks). There is no need to create a separate rule for each of them.

Each parameter must be entered on a separate line, separating consecutive entries only with the ENTERkey. Do not use commas, semicolons, or other separators.

In this case, the ORlogic applies. This means that the rule will be applied if any of the specified conditions is met.

Example - domain masks

*.facebook.com*
*.youtube.com*
*.tiktok.com*

The rule will be applied if the user visits Facebook OR YouTube OR TikTok.

Example - paths

C:\Users\Public\
D:\Documents\
*\Server\Share\*

The rule will be applied if the operation concerns any of the specified paths.

Example - file names

*.pdf
*.docx
*.xlsx

The rule will be applied to any PDF, DOCX, or XLSX file.

Note: The values entered within a single rule are always interpreted according to the ORlogic. Currently, the system does not support AND logic between parameters within the same rule.

Summary

Path, file, and process masks are a flexible tool that enables precise control over DLP rule behavior. With masks, you can focus monitoring on key areas while excluding locations, files, or processes considered irrelevant.