2020 StealthAUDIT® Sensitive Data Discovery Add-on User Guide StealthAUDIT® TOC Sensitive Data Discovery Add-On Overview 3 Sensitive Data Criteria Editor 4 Navigation Pane 4 Configuration Pane 5 Criteria Tester Window 9 Add Sub-Criteria 10 Sensitive Data System Criteria 17 Default Metadata Tag Values 25 Supported Formats for Scanning & Metadata 27 Scan-able Formats 27 Archive 27 Document 28 Email & Messaging 28 Other 28 Presentation 30 Raster Image 30 Spreadsheet 30 Text & Markup 31 Metadata Only Formats 32 Image Files 32 Vector Image 32 Scans Against Files with no Extensions 33 Exempted File Extensions 35 More Information 36 Appendix 37 Doc_ID 652 2 Copyright 2020 STEALTHBITS TECHNOLOGIES, INC. ALL RIGHTS RESERVED StealthAUDIT® Sensitive Data Discovery Add-On Overview The Sensitive Data Discovery Add-On allows StealthAUDIT to scan file content for matches to the sensitive data criteria. There are several pre-defined criteria, but users can also customize existing criteria or create new criteria. The Sensitive Data Discovery Add-on can be used with any of the following StealthAUDIT solu- tions: l AWS Solution l Dropbox Solution l Exchange Solution – Only with specific data collectors: l EWSMailbox Data Collector l EWSPublicFolder Data Collector l ExchangeMailbox Data Collector l File System Solution l PostgreSQL Solution l MongoDB Solution l MySQL Solution l Oracle Solution l SharePoint Solution l SQL Solution NOTE: Changes made in the Sensitive Data Criteria Editor are global for Sensitive Data Dis- covery in StealthAUDIT. In other words, any changes to criteria will affect all solutions using the Sensitive Data Discovery Add-on. See the StealthAUDIT Sensitive Data Discovery Add-On Installation Guide for installation inform- ation and prerequisites. Doc_ID 652 3 Copyright 2020 STEALTHBITS TECHNOLOGIES, INC. ALL RIGHTS RESERVED StealthAUDIT® Sensitive Data Criteria Editor The Sensitive Data Criteria Editor is accessed from the Criteria Tab in the Settings > Sensitive Data node. Use the Sensitive Data Criteria Editor to view pre-defined criteria and to customize or create user-defined criteria. Sensitive Data Criteria can be configured in individual data collectors that use the Sensitive Data Discovery Add-On or can be configured to inherit Sensitive Data Criteria set- tings from the Settings > Sensitive Data node. See the Sensitive Data section of the StealthAUDIT User Guides v11.0 for additional information. The Sensitive Data Criteria Editor contains two sections: l Navigation Pane – User-configured criteria can be added and removed in the Navigation Pane using the Add or Remove options. See the Navigation Pane section for additional information. l Configuration Pane – Displays configured settings for the currently selected criteria in the Nav- igation Pane. See the Configuration Pane section for additional information. Navigation Pane The Navigation Pane lists all user-created and pre-configured Sensitive Data criteria. Doc_ID 652 4 Copyright 2020 STEALTHBITS TECHNOLOGIES, INC. ALL RIGHTS RESERVED StealthAUDIT® The options in the Navigation Pane are: l Add Criteria [1] – Adds a new criteria under the User Criteria list l Remove Criteria [2] – Removes a user-created criteria from the User Criteria list l User Criteria – Lists all user-created criteria l System Criteria – Lists all pre-configured criteria. For a list of pre-configured System Criteria, see the Sensitive Data System Criteria section for additional information. l System Criteria cannot be modified or removed. To use existing System Criteria con- figurations in a User Criteria, right-click on a System Criteria and select Duplicate from the right-click menu. A configurable copy of the System Criteria appears under User Criteria. Configuration Pane Use the Configuration Pane to view sub-criteria information for System Criteria and to view, add, edit, and remove sub-criteria information for User Criteria. Doc_ID 652 5 Copyright 2020 STEALTHBITS TECHNOLOGIES, INC. ALL RIGHTS RESERVED StealthAUDIT® The information in the Configuration Pane changes based on the criteria currently selected in the Navigation Pane. Doc_ID 652 6 Copyright 2020 STEALTHBITS TECHNOLOGIES, INC. ALL RIGHTS RESERVED StealthAUDIT® The options at the top of the Configuration Pane are: NOTE: Configuration settings for System Criteria cannot be modified. l Navigation Path [1] – Displays information on current location within the Sensitive Data Criteria Editor l Name [2] – Name of the criteria as it is shown in the Navigation Pane l Test Criteria Button [3] – Opens the Criteria Tester window to test current criteria con- figurations. See the Criteria Tester Window section for additional information. l Confidence Level [4] – Displays the current confidence level which indicates to users how accur- ate a match is for a criteria l The Confidence Level is reported on a scale from 0 - 100. The closer the number is to 100, the more accurate a match is for a criteria. l Risk Score [5] – Displays the general level of risk a criteria represents when found in a file that is not properly secured l The Risk Score can be set to Low, Medium, or High. l Click the Risk Score button to change the Risk Score for user-configured criteria. l Required matched criteria list [6] – Lists sub-criteria configured for currently selected top-level criteria in the Navigation Pane. The columns in the table are: l Name – Name of the sub-criteria l Type – Type of sub-criteria: Keywords, Regex, or Summary l Content – Values associated with sub-criteria l Minimum Matches – Minimum number of match hits required for a sub-criteria match hit l Match Type – Displays whether the sub-criteria Must Match or Must Not Match Doc_ID 652 7 Copyright 2020 STEALTHBITS TECHNOLOGIES, INC. ALL RIGHTS RESERVED StealthAUDIT® The options at the bottom of the Configuration Pane are: NOTE: Configuration settings for System Criteria cannot be modified. l Add – Add a sub-criteria to the required matched criteria list. The three types of sub-criteria that can be added are Keyword, Regular Expression (Pattern), and Summary. See the Add Sub- Criteria section for additional information. l Remove – Remove sub-criteria from the Required matched sub-criteria list l Edit – Edit the currently selected sub-criteria l Must match at least this many criteria – Adjust the slider to configure how many sub-criteria must be matched for the sensitive data criteria to be reported l The minimum value is 1 l The maximum value is the number of sensitive data sub-criteria that has been added to the required matched criteria list CAUTION: The character distance feature does not account for summaries that are nested within other summaries l Matches should be within this proximity of characters – Match hits for this criteria should be within this many characters of one another in order for there to be a match. Adjust the slider to set the default character distance required for match hits. l The minimum value is 0 l The maximum value is 200 Doc_ID 652 8 Copyright 2020 STEALTHBITS TECHNOLOGIES, INC. ALL RIGHTS RESERVED StealthAUDIT® l Using this feature requires any combination of two or more Regular Expression (Pattern) and Keyword sub-criteria l Include keywords as part of match hits – Check this box to enable the inclusion of keywords as part of match hits l Metadata for this criteria – Click the green (+) button to add a new metadata type for the cri- teria. Delete a metadata type by clicking the X in the gray metadata tag button. l For a list of available out-of-the-box metadata tags, see the Default Metadata Tag Values sec- tion for additional information. l Cancel – Exit the Sensitive Data Criteria Editor without saving changes l Save – Save changes made to the current criteria Criteria Tester Window Use the Criteria Tester window to test current criteria configurations. Doc_ID 652 9 Copyright 2020 STEALTHBITS TECHNOLOGIES, INC. ALL RIGHTS RESERVED StealthAUDIT® The options in the Criteria Tester are: l Use the following sample text – Enter sample text to test against current configured criteria in the Use the following sample text textbox l Use the following file – Click Browse to import a file as sample text to test against currently con- figured criteria l Test Data – Click Test Data to test the sample text against currently configured criteria. Match hits will appear in the Test Results section. l Test Results – Displays match hits for the sample text typed into the text box. The two tabs under Test Results are: l Criteria – Displays the specific criteria for which the sample text is considered a match l Matched Data – Displays the sample text that was matched for the configured criteria Add Sub-Criteria There are three types of sub-criteria that can be added to a top-level criteria in the Sensitive Data Criteria Editor. The following sections summarize configuration option for each sub-criteria. Regular Expression (Pattern) Criteria Regular Expression criteria are a set of pattern matching rules that provide a concise and flex- ible means for matching strings of text. This criteria type can be used to verify a series of numbers as potentially valid, e.g. credit card numbers. Doc_ID 652 10 Copyright 2020 STEALTHBITS TECHNOLOGIES, INC. ALL RIGHTS RESERVED StealthAUDIT® The options on the Regular Expression window are: l Name – Name of the Regular Expression sub-criteria as it appears in the Configuration Window l Expression – Enter the Regular Expression in the Expression text box l Case Sensitive Expression – Check the box for Case Sensitive Regular Expression pattern