CCL Configuration
About this task
Most SophosLabs Content Control Lists (CCLs) have a quantity assigned to them.
A quantity is the volume of the CCL key data type that must be found in a file before the CCL is matched. You can edit the quantity of a SophosLabs CCL by clicking on the CCL name on the "Rule Config" page of the Policy wizard. The quantity for custom CCLs must be edited in Sophos Enterprise Console.
Using quantity, you can fine-tune your data control rules and avoid blocking documents that do not contain sensitive information (for example, a document containing one postal address or one or two telephone numbers, possibly in the letterhead or signature).
If you search for a single postal address, thousands of documents may match the rule and trigger a data control event. However, if you want to prevent the loss of a customer list, you may want to only detect the transfer of documents containing, for example, more than 50 postal addresses. In other cases, however, it may be advisable to search for a single instance of content, for example, a credit card number.
Quantity is the volume of the CCL key data type that must be found in a file before the CCL is matched.
Custom rules use "trigger scores," which are created as part of an advanced CCL. See the Sophos Enterprise Console documentation for more information. A trigger score refers to the number of times a regular expression must be matched before a CCL is matched.
To set the quantity for a rule: