Content detected by predefined EDD rules

This topic provides specific details about the data detected by the DAR component A lightweight software component of the Absolute agent that detects at-risk data stored on a Windows or Mac device during an EDD scan. The DAR component is deployed on a device only when the device is associated with a policy group in which the Endpoint Data Discovery policy is activated. of the Absolute agent, which is installed on a device when the Endpoint Data Discovery Endpoint Data Discovery policies scan the hard drives of your managed Windows and Mac devices for confidential file content, such as personal health information, credit card numbers, and SSNs. Scan results are reported in EDD reports to help you identify at-risk devices. policy is activated. The topic also describes how file content is matched for each predefined EDD rule, and how Match Scores are generated.

NOTE  To find file content that is of particular interest to your organization, you can create one or more custom EDD rules.

About expressions and expression sets

The DAR component uses expressions to identify some types of content, such as SSNs and identifiers. In EDD Rules, an expression consists of a combination of values, variables, operators, and functions that is executed during an EDD scan to detect specific file content. The expressions designed to find a particular type of content are combined into an expression set. When content in a file matches an expression, the file is assigned a Match Score.

About lexicons

The DAR component uses lexicon expression sets to identify some types of content, such as health terms and financial terms. A lexicon uses simple expressions to build a list of words and phrases, which is compared to file content when a device is scanned. When content in a file matches an expression in the lexicon, the file is assigned a Match Score.

Predefined EDD rules

By default, your Absolute account includes a set of predefined EDD rules. You can apply one or more predefined rules to an EDD scan when you configure an EDD policy in the Policies area. The following predefined rules are available: