Working with expression sets

Expressions sets are the largest building blocks of EDD rules. Each rule needs to include at least one expression set, which contains expressions that define a specific type of content. The expressions within a set are joined by OR operators meaning that a match is generated if any individual expression is matched by content in a file.

There is no limit to the number of expression sets that a rule can include, but it's best practice to keep your rule as simple as possible while still meeting the needs of your organization. If you need to add multiple expression sets to a rule, be aware that a match is generated only when an expression in each and every expression set is matched by content in a file.

You can perform the following actions on expression sets:

To add an empty expression set:

  1. On the EDD Rules sidebar, click the rule that you want to edit. The rule opens in the work area.
  2. If the work area is grayed out, the rule is currently used in one or more EDD policies. Click Edit Rule to enable the work area.
  1. Click Add Expression Set and select New. A new expression set is added.
  2. Add one or more expressions to the set.
  3. Optionally, rename the expression set.

To add an expression set that is prepopulated with content specific expressions:

  1. On the EDD Rules sidebar, click the rule that you want to edit. The rule opens in the work area.
  2. If the work area is grayed out, the rule is currently used in one or more EDD policies. Click Edit Rule to enable the work area.
  1. Click Add Expression Set and select a template. A new expression set is added.
  2. Optionally, rename the expression set.
  3. Edit or delete existing expressions, as required.
  4. Add expressions to the set, as required.

By default, every time unique content in a file matches an expression, a Match Score of 1 is added to the total Match Score for a rule. If your rule includes multiple expression sets, meaning that an expression in each and every expression set must be matched for a Match Score to be generated, a Match Score of 1 is generated for each unique match in each expression set. As a result, the Match Score may become inflated, hindering your ability to determine the actual risk associated with a file.

Example
You want to find personal financial information residing on your devices. You create a rule and add two expression set templates: Tax Code ID (Italy) and Financial Terms. An EDD scan runs on a device and finds a file that contains 15 unique Tax Code IDs and 60 unique financial terms. If both expression sets are included in the Match Score calculation, the Match Score for the file is 75, but if you exclude the Financial Terms expression set, the Match Score is 15. This Match Score corresponds to the number of individuals whose financial information may be at risk, which is a more accurate reflection of the risk associated with the file.

NOTE  At least one expression set's Match Score must be included in a rule's total Match Score.

To exclude an expression set's Match Score from the total Match Score:

  1. On the EDD Rules sidebar, click the rule that you want to edit. The rule opens in the work area.
  2. If the work area is grayed out, the rule is currently used in one or more EDD policies. Click Edit Rule to enable the work area.
  1. To the right of the expression set name, click Expression Set Options > Exclude from Match Score.

    2. The expression set's Match Score will be excluded from the rule's total Match Score.

  2. To include an expression set's Match Score that was previously excluded:
    1. Click Expression Set Options. A check mark shows next to Exclude from Match Score.
    2. Click Exclude from Match Score to clear the check mark.

    3. The expression set's Match Score will be included in the rule's total Match Score.

To rename an expression set:

  1. On the EDD Rules sidebar, click the rule that you want to edit. The rule opens in the work area.
  2. If the work area is grayed out, the rule is currently used in one or more EDD policies. Click Edit Rule to enable the work area.
  1. Do one of the following:
    • Click the name of the expression set.
    • To the right of the expression set name, click Expression Set Options > Rename. The expression set name is now editable.
  2. Edit the name of the expression set.
  3. Click anywhere on the page. The expression set name is changed and the Saved date and time update to the current date and time.

To delete an expression set:

  1. On the EDD Rules sidebar, click the rule that you want to edit. The rule opens in the work area.
  2. If the work area is grayed out, the rule is currently used in one or more EDD policies. Click Edit Rule to enable the work area.
  1. To the right of the expression set name you want to delete, click Expression Set Options > Delete.
  2. In the Delete Custom Rule dialog click Delete. The expression set is deleted.
Related Topics Link IconRelated Topics