×
×
×
×

Frequently Asked Questions (FAQ)

Endpoint DLP Data Classification

What are data rules?
Data rules are a set of criteria that is configured by the admin to find specific types of sensitive data. The data rules can be created using pre-defined templates or customizable templates using mechanism such as RegEx, Document Matching, keyword search. During the data discovery process, the agent will comb through the endpoint and find any sensitive data that matches the data rule deployed for that policy.
When to use pre-defined templates?
For common types of sensitive documents such as PII, Health, Finance, Source Code etc. you can browse and select a template according to countries.
When to use custom templates?
To find sensitive documents specific to your organization or circumstance, you can use custom templates to determine the criteria that a document would have to match to be considered as sensitive. Endpoint Central supports custom rules using RegEx, keyword matching, document matching and file extensions.
What happens when multiple policies are deployed to the same endpoint?
The last deployed policy takes effect for that endpoint. You can check what policy is currently active under the managed systems by drilling down into the system's view.
When to use RegEx?
When sensitive data can be detected by the presence of a specific pattern/string in a file, RegEx patterns are utilized. These patterns can be predicted and then searched for in order to identify a match.
When to use keyword search to find documents?
Keyword search is used to seek for specific keywords in a document that could make it sensitive and thus inappropriate for transfer outside the organization.
When to use document matching to detect sensitive documents?
Document Matching is a preferred technique over RegEx in cases where sensitive data cannot by identified by an exact match but may be detected by identifying similar templates and analyzing their match percentage.
What are enterprise boundaries and how are they defined?
Boundary definition refers to restrictions that the admin can configure which dictate the boundaries within which a particular type of sensitive data can be processed. The boundaries include email, miscellaneous cloud web applications, peripheral devices etc.
What is the meaning of occurrence count in regex rules?
Occurrence count in a RegEx rule refers to the minimum number of times a pattern has to occur for it to be considered sensitive. For example, if a pattern's occurrence count is 2, the file can be considered sensitive if the pattern appears two or more times.
What is the difference between keyword matching and document matching?
While keyword matching focuses on identifying specific keywords that are considered sensitive in the document, document matching compares the overall similarity of the provided document to the format that is considered sensitive.
What is "match percentage" in document matching?
The percentage of accuracy at which the submitted document can be considered comparable to the sensitive template is referred to as the match percentage in document matching. Increasing the match percentage required to classify a document as sensitive can help improve detection accuracy and reduce false positives.
What causes the "Oops, Something went wrong! File upload is not successful" error when uploading a Document Matching template?

This generic error can result from several conditions during Document Matching template upload. Check the following in order:

Most Common Causes

  1. File contains fewer than 10 words: Document Matching requires the template file to contain at least 10 words. Verify your file meets this requirement.
  2. File is corrupted or unreadable: The upload may fail if the file is damaged, incomplete, or in an unexpected format. Re-save or re-create the file and try again.
  3. File format not supported: Only DOC, DOCX, and PDF files are supported. Verify your file is in one of these formats (not DOCM, XLSM, or other variants).
  4. PDF-specific issues:
    • Password-protected or encrypted PDFs cannot be uploaded
    • Scanned PDFs (image-only, no extractable text) may fail if fewer than 10 words can be extracted
    • Malformed or corrupted PDF files may be rejected
  5. File size exceeds limit: Very large files (typically >100MB) may fail. Reduce file size and retry.
  6. Browser or network issue:
    • Try uploading from a different browser or incognito/private mode
    • Check your network connectivity
    • Clear browser cache and cookies
  7. Server-side issue: If all above checks pass, contact ManageEngine support with:
    • Browser console error details (press F12 → Console tab)
    • Network request details showing the upload failure (F12 → Network tab)
    • The file name, size, and format being uploaded

To Troubleshoot

  1. Verify file content: Open the file and confirm it contains at least 10 words
  2. Test with a simple file: Create a basic .docx file with 10+ words and attempt upload to isolate the issue
  3. Check browser console: Open F12 (Developer Tools) → Console tab to see if there are error messages
  4. Try different browser: Upload from Chrome, Firefox, or Edge to determine if the issue is browser-specific
What are the prerequisites and limitations for PDF files used as Document Matching templates?

Endpoint Central Document Matching accepts PDF files, but they must meet specific requirements.

PDF Requirements

  • Minimum 10 words: The PDF must contain at least 10 extractable words
  • Not password-protected: Password-protected or encrypted PDFs cannot be uploaded
  • Extractable text: PDFs must have text that can be extracted (not image-only)
  • Valid PDF format: The file must be a valid, non-corrupted PDF
  • File size: Recommended maximum ~100MB (server configuration may vary)

Supported PDF Types

  • Text-based PDFs: PDFs created from Word/Excel/PowerPoint or with embedded text
  • PDFs with mixed content: Text + images are supported
  • Scanned PDFs: Image-only PDFs without OCR are NOT supported. Scanned PDFs fail if they contain fewer than 10 extractable words

NOT Supported

  • Password-protected PDFs (encrypted with a password)
  • Digitally signed PDFs (may have extraction restrictions)
  • Image-only/scanned PDFs without text extraction capability
  • PDFs with restricted permissions (copy/extract disabled)

If Your PDF Upload Fails

For scanned PDFs: Apply OCR (Optical Character Recognition) using a tool like Adobe Acrobat or free online OCR services to convert the image to extractable text, then upload the OCR'd PDF.

For password-protected PDFs: Remove the password protection using a PDF editor, then upload.

For other issues: Verify the PDF is not corrupted by opening it in Adobe Reader or your browser. If it opens successfully with visible text, retry the upload.

Important Notes

  • Endpoint Central does NOT perform OCR during upload. If you have a scanned PDF, you must apply OCR beforehand.
  • The 10-word requirement applies to extractable text only. A PDF with 5 words + 5 images will fail.
  • Match percentage in Document Matching is configured after upload and does not affect whether the upload succeeds.
What is data leakage prevention for "content-based classification"?
Configuring data leakage prevention policies depends on the type of classification opted to classify a file as sensitive. They are: content-based and context-based classification.
Marking a file as sensitive when the file contents matches a RegEx pattern or a keyword/document is content-based classification.
Context-based classification classifies a file as sensitive, based on the file properties (password-protected or file extension-based) and the nature of the file origin (a file downloaded from an enterprise-marked application).
Which files with Embedded Objects will be scanned?
The agent will scan embedded files within .docx, .xlsx, and .pptx formats for sensitive data.
When is a file considered sensitive in a Keyword Matching rule?
A file is considered sensitive only when the same keyword appears at least as many times as the defined Minimum Word Match Count; occurrences of different keywords are not combined.
Does Endpoint Central detect sensitive data in encrypted or password-protected files?
No. Endpoint Central cannot detect sensitive data within encrypted or password-protected files. However, password-protected files can be classified as sensitive and handled according to the configured policy. Supported file types include 7z, ZIP, TAR, Bzip2, XZ, Gzip, RAR, RAR4, RAR5, WIM, ISO, ARG, and ISOUDF.
Can Endpoint DLP search for files by filename using regex patterns?
No. Endpoint Central currently does not support filename matching or filename-based regex patterns. Data rules support content-based matching only (Regex patterns, keyword matching, document matching) and file extensions. Filename filtering is not available as a classification criterion.
Why is my Regex pattern not detecting the expected values in files, even though the pattern looks correct?

If a Regex pattern fails to detect expected values while keyword matching succeeds, check the following:

Common Regex Issues

  1. Word Boundary Mismatches:
    • Pattern: \b\d{3}-\d{6}\b (with word boundaries)
    • Problem: May not match if the pattern is adjacent to non-word characters or in specific contexts
    • Solution: Test without word boundaries: \d{3}-\d{6}
  2. Pattern Syntax Differences:Endpoint Central uses standard Perl-compatible Regex (PCRE)
    • Verify syntax: \d (digit), \D (non-digit), \w (word char), \s (whitespace)
    • Character classes: [0-9] is equivalent to \d
    • Quantifiers: + (one or more), * (zero or more), {3} (exactly 3)
  3. Anchors (^ and $):
    • ^pattern$ requires the entire line to match the pattern only
    • Solution: Remove anchors if the pattern appears anywhere in the file: pattern
  4. Line-by-Line vs Full-Text Matching: Regex may process files line-by-line, not as continuous text
    • If your pattern spans multiple lines, it may not match
    • Solution: Test if the pattern appears on a single line in the file
  5. Occurrence Count Too High:
    • If occurrence count is set to 5 but the pattern appears only 3 times, the file won't be classified as sensitive
    • Solution: Lower the occurrence count or verify the pattern actually matches multiple times
  6. File Encoding Issues:
    • UTF-8, ASCII, or other encodings may affect pattern matching
    • Solution: Ensure the file is in UTF-8 or ASCII encoding
  7. Regex Not Deployed or Inactive:
    • Verify the Regex rule is included in an active DLP policy
    • Confirm the policy is deployed to the target endpoint
    • Check policy refresh status (default 90 minutes)

Debugging Steps

  1. Create a minimal test file: Save a file with ONLY the value you're trying to match (e.g., "123-456789" on a single line)
  2. Deploy a DLP policy with your Regex rule to a test computer
  3. Test the file on that computer to see if it's classified as sensitive
  4. If it fails, try simplifying the regex:
    • Original: \b\d{3}-\d{6}\b
    • Simplified: \d{3}-\d{6}
    • More permissive: \d{3}\-\d{6} (escape the hyphen)
  5. Check audit logs: Go to DLP → Reports → DLP Sensitive Events to see if the file was analyzed and which rule matched (or didn't match)
  6. Test with Keyword Matching as reference: If keywords work but Regex doesn't, the issue is likely Regex syntax or pattern scope

Common Pattern Examples (Tested)

PatternMatchesNotes
\d{3}-\d{6}123-456789Simple pattern without anchors (recommended)
[0-9]{3}-[0-9]{6}123-456789Equivalent to above, using character class
\d{3}\-\d{6}123-456789Hyphen escaped (sometimes needed)
\b\d{3}-\d{6}\b123-456789 (with word boundaries)More restrictive; may fail in some contexts

Important: If multiple Regex patterns fail to detect values that Keyword Matching catches, the issue may be in how the file is being scanned, the encoding, or the pattern context. Provide the failing patterns, sample test files, and audit logs to ManageEngine support for deeper investigation.

Can Endpoint DLP classify files based on document metadata (author, title, custom properties)?
No. Endpoint Central does not support document metadata inspection. Classification is based on file content (Regex, keywords, document matching), file extensions, and limited file properties (password protection, file origin). Feature request: To request metadata-based classification, submit your requirement via the Product Roadmap portal.

Policy Association & Deployment

What is false positive?
In a DLP solution, a false positive occurs when the solution indicates that a DLP policy has been violated even when it hasn't. A false positive can happen as a result of a data detection error or because the file's destination is not approved for sensitive file transfer.
What is business justification?
End users may be required to send sensitive files outside the enterprise perimeter for official purposes. In such cases, they may be allowed to override the policy citing a suitable justification and proceed to transfer the files.
What is override and who should be allowed to implement them?
Override refers to the ability to carry through a DLP action despite the event of a false positive. Override permission should be granted to privileged users and users who frequently contact outside the organization.
What does "Audit Only" mean in DLP policy?
In "Audit mode", the sensitive files will be allowed to be transferred within and outside the enterprise perimeter. The enterprise perimeter defines the restrictions that the admin can configure to dictate the boundaries within which the sensitive data can be processed. However, only the files transferred outside the enterprise perimeter will be audited and can be viewed in the "DLP Sensitive Events Report". The report will give you insights on how to add/remove entries to your DLP Policy without affecting productivity. This applies to the policies of File Access, Email Client, File Upload, Removable Storage Devices, and Printing.
What does "Block within Trusted Applications" mean under Screen Capture?
Since the content given on screen cannot be scanned, they cannot be classified as sensitive data. So the data handled by "Trusted Applications" will be classified as sensitive and the "Block within Trusted Applications" option will restrict screen capture functionality within those applications.
Which versions of Microsoft Outlook are supported by the Email Client Policy?
The Email client policy supports the following versions of Microsoft Outlook:
  • Version 15.0.x
    • Microsoft Outlook 2013
  • Version 16.0.x
    • Microsoft Outlook 2019
    • Microsoft Outlook 2021
    • Microsoft Outlook for Microsoft 365
Is the Email DLP policy supported on web-based email clients?
No. The Email DLP policy is applicable only to the Microsoft Outlook Desktop application. Web-based email clients, including Outlook on the Web (OWA) and other webmail services, are not supported.
Does Endpoint Central support both blacklisting and whitelisting?
Endpoint Central supports the configuration of trusted applications, domains, email domains, printers, and removable storage devices. Blacklisting is not supported.
Can Endpoint DLP encrypt files when sharing through Teams or SharePoint?
No. Endpoint Central does not provide per-file encryption or automatic encryption for cloud-app shares. Available controls are audit-only, allow within trusted domains, or block sensitive file uploads. For file encryption at rest, use BitLocker or equivalent drive-level encryption on the endpoint.
Can I add a watermark to desktop screenshots to identify sensitive content?
No. Endpoint Central does not support watermarking for screen captures. The Block Within Trusted Applications option restricts screenshots within designated applications, but does not add watermarks. Custom watermarks are available for printer output only, not screen content.
Can I restrict sensitive file transfers to network drives (UNC paths, mapped drives)?
No. Endpoint Central does not provide controls for network drive transfers. Monitored channels are limited to email, web uploads, removable storage, printers, Bluetooth, clipboard, and applications. Local file operations to mapped drives or UNC paths are not tracked or restricted by DLP policies.