Working with expressions

EDD rules contain sets of expressions that are used by Endpoint Data Discovery (EDD) policies to detect confidential and at-risk file content stored on the hard drives of your devices.

An expression can be a single word or phrase, such as "account number", or it can include a combination of words, variables, operators, and special characters. When you add an expression to an expression set, you need to use the correct syntax.

To protect confidential data, use the @Mask_After and the @Mask_Upto operators to redact personal information.

To view a rule's expressions, your user role needs to be granted the View permission for Endpoint Data Discovery. To manage a rule's expressions, your user role needs to be granted the Manage permission for Endpoint Data Discovery. All Administrator roles are granted these permissions.

To add an expression to an expression set:

  1. On the navigation bar, click Policies > EDD Rules.

  2. After searching for the rule, click its name, or hover over its row and click . The rule opens.

  3. If the expression set you want to edit is collapsed, click its icon. The expression set expands.
  4. Click Add Expression. A new row is added to the expression set.

  5. Enter the expression using supported syntax. If Syntax error or a specific error message shows after you click away from the expression field, the syntax is not supported. You need to correct the expression's syntax before you can publish your rule.

    Regular expressions must be enclosed in forward slashes (for example, /<regex>/).

  6. In the Add description field below the expression, enter additional information to describe the expression, if desired.
  7. To ensure that the expression is yielding the desired results, test your expression.
  8. Click Save , or if the rule is unpublished and you want to publish it, click Publish.

To edit an expression:

  1. On the navigation bar, click Policies > EDD Rules.

  2. After searching for the rule, click its name, or hover over its row and click . The rule opens.

  3. f the expression set you want to edit is collapsed, click its icon. The expression set expands.
  4. Update the expression text using supported syntax. If Syntax error or a specific error message shows after you click away from the expression field, the syntax is not supported. You need to correct the expression's syntax before you can publish your rule.
  5. [Optional] Update the description of the expression.
  6. To ensure that the expression is yielding the desired results, test your expression.
  7. Click Save , or if the rule is unpublished and you want to publish it, click Publish.

You can delete an expression from a rule's expression set.

To delete an expression:

  1. On the navigation bar, click Policies > EDD Rules.

  2. After searching for the rule, click its name, or hover over its row and click . The rule opens.

  3. If the expression set you want to edit is collapsed, click its icon. The expression set expands.
  4. Click the icon next to the expression that you want to delete. The expression is removed from the expression set.
  5. Click Save , or if the rule is unpublished and you want to publish it, click Publish.