Veritas Enterprise Vault™ Classification using the Veritas Information Classifier
- About this guide
- Preparing Enterprise Vault for classification
- Setting up Veritas Information Classifier policies
- Defining and applying Enterprise Vault classification policies
- About Enterprise Vault classification policies
- Defining classification policies
- About the PowerShell cmdlets for working with classification policies
- Associating classification policies with retention plans
- About the PowerShell cmdlets for working with retention plans
- Applying retention plans to your Enterprise Vault archives
- Running classification in test mode
- Appendix A. Enterprise Vault properties for use in custom field searches
- About the Enterprise Vault properties
- System properties
- Attachment properties
- Custom Enterprise Vault properties
- Custom Enterprise Vault properties for File System Archiving items
- Custom Enterprise Vault properties for SharePoint items
- Custom Enterprise Vault properties for Compliance Accelerator-processed items
- Custom properties for use by policy management software
- Custom properties for Enterprise Vault SMTP Archiving
- Appendix B. PowerShell cmdlets for use with classification
- About the classification cmdlets
- Disable-EVClassification
- Get-EVClassificationPolicy
- Get-EVClassificationStatus
- Get-EVClassificationTestMode
- Get-EVClassificationVICTags
- Initialize-EVClassificationVIC
- New-EVClassificationPolicy
- Remove-EVClassificationPolicy
- Set-EVClassificationPolicy
- Set-EVClassificationTestMode
- Appendix C. Classification cache folder
- Appendix D. Migrating from FCI classification to the Veritas Information Classifier
- Appendix E. Monitoring and troubleshooting
About policy conditions
A condition specifies the criteria that an item must meet for the Veritas Information Classifier to consider it a match. Your policies can contain any number of conditions.
This topic provides information on the following:
All conditions have this basic form:
property operator value
For example, in the following condition, "Content" is the property, "contains text" is the operator, and "Stocks" is the value:
The property specifies the part or characteristic of an item that you want to evaluate: its content, title, modified date, file size, and so on. When you choose a property from the list, the options in the two other fields change to suit it. For example, if you choose the "Modified date" property, the other fields provide options with which you can set one or more dates. For properties such as "Content", "Title", and "Author", the available operators are as follows:
contains text
matches regex
matches pattern
The following sections describe how to enter the required values to look for text, regular expression, and pattern matches.
At the right of each condition, you can specify the minimum number of times that an item must meet the criteria for the Veritas Information Classifier to consider it a match.
Various applications that you use in your organization may add custom property information to the items that you want to classify. For example, when Enterprise Vault processes an item, it populates a number of the item's metadata properties with information and stores this information with the archived item: the date on which Enterprise Vault archived the item, the number of attachments that it has, and so on.
If you know the name of a property that particularly interests you, you can enter it as a custom field in your policy conditions.
See About the Enterprise Vault properties.
Observe the following guidelines when you set up a condition to look for specific words or phrases in the items that you submit for classification:
The condition can look for multiple words or phrases, if you place each one on a line of its own. An item needs to contain just one word or phrase in the list to meet the condition.
Select to find only exact matches for the uppercase and lowercase characters in the specified words or phrases.
Select to find instances where the specified words or phrases are contained within other ones. For example, if you select this option, the word enter matches enters, entertainment and carpenter. If you clear the option, enter matches only enter.
Similarly, if you select , the phrase call me matches call media and recall meeting, but not surgically mend.
You can place the proximity operators NEAR and BEFORE between two words in the same line. For example, tax NEAR/10 reform matches instances where there are no more than ten words between tax and reform. sales BEFORE/5 report matches instances where sales precedes report and there are no more than five words between them. The number is mandatory in both cases.
Word and phrases can include the asterisk (*) and question mark (?) wildcard characters. As part of a word, an asterisk matches zero or more characters. On its own, the asterisk matches exactly one word. A question mark matches exactly one character. For example:
stock* matches stock, stocks, and stockings.
*ock matches stock and clock.
*ock* matches stock and clocks.
??ock matches stock and clock, but not dock.
sell * stock matches sell the stock and sell some stock, but not sell stock.
You can use wildcards in combination with the NEAR and BEFORE operators. For example:
s?l? BEFORE/1 stock* matches sold the stock, sell stocks, and sale of stockings.
A regular expression, or regex for short, is a pattern of text that consists of ordinary characters (for example, letters a through z) and special characters, called metacharacters. The pattern describes one or more strings to match when searching text. For example, the following regular expression matches the sequence of digits in all Visa card numbers:
\b4[0-9]{12}(?:[0-9]{3})?\bYour regular expressions must conform to the Perl regular expression syntax. For more information on this syntax, see the following article:
http://perldoc.perl.org/perlre.html
For the best results, we recommend that you use the basic features of this syntax only and avoid more advanced features, such as lookaheads and lookbehinds.
A pattern match evaluates the selected item property against an existing Veritas Information Classifier pattern. If you choose a built-in pattern, you can set the confidence levels that you are willing to accept. A high confidence level is likely to produce fewer but more relevant matches. You cannot set the confidence levels for any custom patterns that you have created.
Note the following if you do not get the expected results when you test a policy that makes use of a built-in pattern:
It is important to check that your test item meets the pattern confidence levels. For example, by default, the Credit Card Policy looks for content that matches the pattern "Credit/Debit Card Number" with medium to very high confidence. To meet the requirements of the medium confidence level, an item must contain either of the following:
A delimited credit card number (one that contains spaces or dashes between the numbers).
Both a non-delimited credit card number and one or more credit card keywords, such as "AMEX" or "Visa".
So, an item does not meet these requirements if it contains a non-delimited credit card number but it does not also contain credit card keywords.
After you click to view the results of a test, the Test classification results window may fail to highlight some or all of the matches. This is a known issue with certain patterns only. A future version of the Veritas Information Classifier will correct the issue.
You can group a set of conditions and nest grouped conditions within other grouped conditions. The group operator that you choose determines whether an item must meet all, some, or none of the conditions in the group to be considered a match. The following group operators are available:
All of. An item must meet all the specified conditions.
Any of. An item must meet at least one of the specified conditions.
None of. An item must not meet any of the specified conditions.
Note:
You can nest a None of group within an All of group to look for certain condition matches while also excluding others. For example, to achieve the effect of "(condition X AND condition Y) BUT NOT condition Z", you would include the X and Y conditions in an All of group and the Z condition in a nested None of group.
n or more of. An item must meet the specified number of conditions.
For an All of group only, you can choose to look for instances where the conditions occur within a specified number of characters of each other. For example, the following condition group looks for instances where the word Goodbye appears within 20 characters of the word Hello:
The text string "You say Goodbye and I say Hello" matches these conditions because there are fewer than 20 characters between the first character of Hello and the first character of Goodbye. Similarly, the string "You say Hello and I say Goodbye" also matches because there are fewer than 20 characters between the ends of the two words. In each case, the spaces count as characters.
Note:
When you conduct within nn characters proximity searches, take care not to duplicate the same search terms across multiple conditions. For example, suppose that you define one condition to look for the names Fred, Sue, and Bob, and a second to look for Joe, Bob, and Sarah. An item that contains a single instance of Bob would match these conditions.
Rather than choose the option, you can choose . This option looks for instances where the conditions occur within any sequence of characters of the specified number. For example, a condition group that looks for instances where the word Goodbye appears within a 20-character sliding window of the word Hello does not match "You say Goodbye and I say Hello". There are 23 characters between the start of the word Goodbye and the end of the word Hello.
