Skip to content

Commit 993f8c0

Browse files
chrisdachrisda
authored
Merge pull request MicrosoftDocs#9960 from MicrosoftDocs/DLPAdvCond-chrisda
DLPAdvCond-chrisda to Main
2 parents c5e0c13 + 0e384cb commit 993f8c0

File tree

2 files changed

+174
-0
lines changed

2 files changed

+174
-0
lines changed

‎exchange/exchange-ps/exchange/New-DlpComplianceRule.md

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ New-DlpComplianceRule [-Name] <String> -Policy <PolicyIdParameter>
2525
[-AccessScope <AccessScope>]
2626
[-ActivationDate <DateTime>]
2727
[-AddRecipients <PswsHashtable>]
28+
[-AdvancedRule <String>]
2829
[-AlertProperties <PswsHashtable>]
2930
[-AnyOfRecipientAddressContainsWords <MultiValuedProperty>]
3031
[-AnyOfRecipientAddressMatchesPatterns <MultiValuedProperty>]
@@ -214,6 +215,72 @@ New-DLPComplianceRule -Name "Contoso Medical Information" -Policy "Contoso Medic
214215

215216
This example create a new DLP compliance rule named "Contoso Medical Information" that is assigned to the "Contoso Medical Checks" policy. The rule uses advanced syntax to search for the specified content.
216217

218+
### Example 3
219+
```powershell
220+
Contents of the file named C:\Data\Sensitive Type.txt:
221+
222+
{
223+
"Version": "1.0",
224+
"Condition": {
225+
"Operator": "And",
226+
"SubConditions": [
227+
{
228+
"ConditionName": "ContentContainsSensitiveInformation",
229+
"Value": [
230+
{
231+
"groups": [
232+
{
233+
"Operator": "Or",
234+
"labels": [
235+
{
236+
"name": "defa4170-0d19-0005-000a-bc88714345d2",
237+
"type": "Sensitivity"
238+
}
239+
],
240+
"name": "Default",
241+
"sensitivetypes": [
242+
{
243+
"confidencelevel": "Low",
244+
"name": "Credit Card Number"
245+
}
246+
]
247+
}
248+
]
249+
}
250+
]
251+
},
252+
{
253+
"Operator": "Not",
254+
"SubConditions": [
255+
{
256+
"Operator": "OR",
257+
"SubConditions": [
258+
{
259+
"ConditionName": "FromMemberOf",
260+
"Value": [
261+
"[email protected]"
262+
]
263+
},
264+
{
265+
"ConditionName": "SentTo",
266+
"Value": [
267+
"[email protected]"
268+
]
269+
}
270+
],
271+
}
272+
]
273+
}
274+
]
275+
}
276+
}
277+
278+
$data = Get-Content -Path "C:\Data\Sensitive Type.txt" -ReadCount 0
279+
New-DLPComplianceRule -Name "Contoso Rule 1" -Policy "Contoso Policy 1" -AdvancedRule $data -NotifyUer
280+
```
281+
282+
This example uses the AdvancedRule parameter to read the following complex condition from a file: "Content contains sensitive information: "Credit card number OR Highly confidential" AND (NOT (Sender is a member of "Jane's Team" OR Recipient is "[email protected]")).
283+
217284
## PARAMETERS
218285

219286
### -Name
@@ -310,6 +377,26 @@ Accept pipeline input: False
310377
Accept wildcard characters: False
311378
```
312379

380+
### -AdvancedRule
381+
The AdvancedRule parameter uses complex rule syntax that supports multiple AND, OR, and NOT operators and nested groups.
382+
383+
This parameter uses JSON syntax that's similar to the traditional advanced syntax in Example 2, but read from a file that contains additional operators and combinations that aren't traditionally supported.
384+
385+
For syntax details, see Example 3.
386+
387+
```yaml
388+
Type: String
389+
Parameter Sets: Default
390+
Aliases:
391+
Applicable: Security & Compliance
392+
393+
Required: False
394+
Position: Named
395+
Default value: None
396+
Accept pipeline input: False
397+
Accept wildcard characters: False
398+
```
399+
313400
### -AlertProperties
314401
{{ Fill AlertProperties Description }}
315402

‎exchange/exchange-ps/exchange/Set-DlpComplianceRule.md

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ Set-DlpComplianceRule [-Identity] <ComplianceRuleIdParameter>
2525
[-AccessScope <AccessScope>]
2626
[-ActivationDate <DateTime>]
2727
[-AddRecipients <PswsHashtable>]
28+
[-AdvancedRule <String>]
2829
[-AlertProperties <PswsHashtable>]
2930
[-AnyOfRecipientAddressContainsWords <MultiValuedProperty>]
3031
[-AnyOfRecipientAddressMatchesPatterns <MultiValuedProperty>]
@@ -167,6 +168,72 @@ Set-DlpComplianceRule -Identity 25bf67b6-3783-4f74-bde9-98dd40333082 -AccessScop
167168

168169
This example modifies the access scope and blocking behavior of a DLP compliance rule that's identified by its GUID value.
169170

171+
### Example 2
172+
```powershell
173+
Contents of the file named C:\Data\Sensitive Type.txt:
174+
175+
{
176+
"Version": "1.0",
177+
"Condition": {
178+
"Operator": "And",
179+
"SubConditions": [
180+
{
181+
"ConditionName": "ContentContainsSensitiveInformation",
182+
"Value": [
183+
{
184+
"groups": [
185+
{
186+
"Operator": "Or",
187+
"labels": [
188+
{
189+
"name": "defa4170-0d19-0005-000a-bc88714345d2",
190+
"type": "Sensitivity"
191+
}
192+
],
193+
"name": "Default",
194+
"sensitivetypes": [
195+
{
196+
"confidencelevel": "Low",
197+
"name": "Credit Card Number"
198+
}
199+
]
200+
}
201+
]
202+
}
203+
]
204+
},
205+
{
206+
"Operator": "Not",
207+
"SubConditions": [
208+
{
209+
"Operator": "OR",
210+
"SubConditions": [
211+
{
212+
"ConditionName": "FromMemberOf",
213+
"Value": [
214+
"[email protected]"
215+
]
216+
},
217+
{
218+
"ConditionName": "SentTo",
219+
"Value": [
220+
"[email protected]"
221+
]
222+
}
223+
],
224+
}
225+
]
226+
}
227+
]
228+
}
229+
}
230+
231+
$data = Get-Content -Path "C:\Data\Sensitive Type.txt" -ReadCount 0
232+
Set-DLPComplianceRule -Identity "Contoso Rule 1" -AdvancedRule $data
233+
```
234+
235+
This example uses the AdvancedRule parameter to read the following complex condition from a file: "Content contains sensitive information: "Credit card number OR Highly confidential" AND (NOT (Sender is a member of "Jane's Team" OR Recipient is "[email protected]")).
236+
170237
## PARAMETERS
171238

172239
### -Identity
@@ -247,6 +314,26 @@ Accept pipeline input: False
247314
Accept wildcard characters: False
248315
```
249316

317+
### -AdvancedRule
318+
The AdvancedRule parameter uses complex rule syntax that supports multiple AND, OR, and NOT operators and nested groups.
319+
320+
This parameter uses JSON syntax that's similar to the traditional advanced syntax, but read from a file that contains additional operators and combinations that aren't traditionally supported.
321+
322+
For syntax details, see Example 2.
323+
324+
```yaml
325+
Type: String
326+
Parameter Sets: Default
327+
Aliases:
328+
Applicable: Security & Compliance
329+
330+
Required: False
331+
Position: Named
332+
Default value: None
333+
Accept pipeline input: False
334+
Accept wildcard characters: False
335+
```
336+
250337
### -AlertProperties
251338
{{ Fill AlertProperties Description }}
252339

0 commit comments

Comments
 (0)