Pattern to exclude

Administrators can define a list of exceptions to a regular expression, script, or dictionary classifier.

Use this field to define a regular expression pattern that will suppress matching content when it includes known false positives or benign data structures. When a regular expression match is found, Forcepoint checks whether the matched content or surrounding context matches the exclusion pattern. If it does, the match is ignored, and no action is taken for that portion of the content.

For each content item transmitted, the system tallies the number of instances of the pattern, and subtracts any matches in the Exclude list.

Example:

The email contains 7 Social Security numbers: 111-11-1111, 222-33-4444, 444- 55-6666, 555-66-7777, 222-22-2222, 777-88-9999, 333-33-3333.

The number of pattern matches is 7, minus 3 excluded patterns that were found in the email, thus equal to 4. Since 4 is greater than the number of matches (2), the message triggers the action specified in the rule that uses this pattern.