My email filtering appliance has an encrypt-on-demand function that's triggered by the presence of a keyword. If the keyword ("EncryptThis") is present in the subject line, the email is encrypted and sent.
I have a custom sensitive information type to identify id numbers. It needs to *not* flag an email as a violation of policy *if* the keyword is present, because the email will be encrypted.
According to the documentation, the way to do this is set up a false positives keyword list:
<Keyword id="Keyword_false_positives">
<Group matchStyle="word">
<Term>EncryptThis</Term>
</Group>
</Keyword>
and check for it in the Entity section with maxMatches = "0"
<Pattern confidenceLevel="90">
<IdMatch idRef="Regex_my__custom_id"/>
<Match idRef="Keyword_my_id"/>
<Any maxMatches="0">
<Match idRef="Keyword_false_positives" />
</Any>
</Pattern>
However, that fails with:
PS C:\Users\xxxxxx> Set-DlpSensitiveInformationTypeRulePackage -FileData (Get-Content -Path "C:\Users\xxxxx\Desktop\dlp scratch\my sensitive type.xml" -Encoding Byte)
Sensitive Information Type data is invalid.
+ CategoryInfo : NotSpecified: (:) [Set-DlpSensitiv...TypeRulePackage], SensitiveInform...utDataException
+ FullyQualifiedErrorId : [Server=BL2NAM02WS017,RequestId=f6b14182-aa46-456c-8814-376a8062d00a,TimeStamp=6/16/2017 11:00:05 PM] [FailureCategory=Cmdlet-SensitiveInforma
tionTypeInvalidInputDataException] 462C6432,Microsoft.Office.CompliancePolicy.Tasks.SetDlpSensitiveInformationTypeRulePackage
Changing the "0" to a "1" fixes the issue, so I know that's what the parser is choking on. But if "0" isn't a valid value for maxMatches, how do I implement the false positive keywords?
Thanks all!
