Custom DLP

Organization-specific regex/keyword detectors.

Organization-specific regex/keyword detectors.

This screen belongs to the Secure deployment operator, not an ordinary hosted customer. Hosted customers have a separate account page with their own keys and limits; policy and service settings are not exposed there. Contact the operator to change protection. In the operator console, open the route listed above; a report tenant filter does not automatically scope a global setting.

Examples use educational data. Use your own authorized tenant in real integrations. Each screenshot shows the actual frontend, with the source and educational/demo mode stated below it.

Prerequisite checked on 2026-10-15. The shared hosted stand did not have a detector file configured. The screenshot uses an isolated real staging installation with the documented synthetic sample enabled. If your console shows Custom DLP disabled, the service operator must mount the patterns file and configure IAM_SEC_CUSTOM_DLP_PATH; Reload cannot create a missing file or configure this environment variable.

Step-by-step actions

  1. Give the operator the detailed-settings sample file: org.customer_id, DOCS-CUST-[0-9]{6} regex, check dlp, severity high.
  2. After IAM_SEC_CUSTOM_DLP_PATH setup, open Custom DLP → Reload.
  3. Locate the ID, enter DOCS-CUST-123456 and Test.
  4. Use DOCS-CUST-12345 as a negative sample.
  5. Create a scoped rule for org.customer_id and verify the final decision.

Every control and its meaning

Control / parameterValues, units and effect
id / name / checkJSON file uses unique id, name and category secret/pii/dlp/toxicity. Policy references the ID with when.data_class.
severity / regex / keywordsseverity low/medium/high/critical, default medium; regex uses Go/RE2; keywords are case-insensitive substrings. Supply regex or nonempty keywords.
IAM_SEC_CUSTOM_DLP_PATH / ReloadThe operator configures the patterns file; Reload rereads it. The console has no pattern creation/file editor.
Проверка текста / TestShows matched and masked_text. Tests patterns rather than all active policies.

Verify the result

Check loaded count, matched and no match for the negative sample. Detectors are gateway-wide; policy constrains their actions.

Errors, disabling and reverting changes

400/reload_failed retains the last loaded set. Correct RE2/JSON and retry. Remove a pattern from the file to disable it, reload and review policies referencing its ID.

Custom DLP · loaded pattern and actual masking of a synthetic ID
Custom DLP · loaded pattern and actual masking of a synthetic ID
2026-10-15 · Working application on a separate Kubernetes staging stand. Synthetic org.customer_id configured through IAM_SEC_CUSTOM_DLP_PATH; reload, positive and negative samples verified. This is a read-only detector preview, not inference or proof of configuration in shared production. Original pixels are unmodified; profile and secrets excluded.
  1. Reload file
  2. Loaded detector
  3. Sample text
  4. Test
  5. Masked result

Detailed security settings · Traffic analysis · FAQ · All application sections