Cloud App Security Administration Guide for G Suite

Managing Policies > Creating New Policy Rules > Creating Data Leak Protection Policy Rules > Using Regular Expressions in DLP Policies for Email
Table of Contents

Using Regular Expressions in DLP Policies for Email

Using regular expressions, you can configure specific DLP policies to be triggered based on the content of the subject line of an email message.

Regular expression support for Data Leak Protection (DLP) requires an Advanced license for Cloud App Security.

For example:

  • If the policy of your organization is to include the word "Confidential" in the subject line whenever an email with confidential data is sent outside of your organization, your DLP policy rule can instruct the sender of the email message to include the keyword "Confidential" when it was added automatically by Cloud App Security to the subject line of the email message.
  • Including the keyword "ENCRYPT" in the subject line of the email message will cause it be encrypted before it is sent to the intended recipient.

Regular expression support is only available for the subject line of email messages. It is not supported within the content of the email messages.

To configure regular expression support

  1. Navigate to Policy.

  2. Select an existing DLP policy or create a new one.

    Regular expression support for email notifications is only available for DLP policies.

  3. In the DLP Criteria section, select Detect Phrases in Email Subject.
  4. In the Phrase to detect (Regular Expression) field, enter the text or regular expression to be evaluated.
  5. From the DLP workflow list, select Email is allowed. Encrypted by Microsoft.
  6. In the Alerts section, you select:

    • Send email alert to sender when Subject Regex is used to have an email message sent to the sender when

      • Click the gears icon to modify the email message sent to the sender.

    • Send email alert to sender when Subject Regex is not used to have an email message sent to the sender when

      • Click the gears icon to modify the email message sent to the sender.
  7. Click Save and Apply.