You can use a DLP custom rule to scan your network traffic for special phrases that are specific to your organization. This allows you to customize your DLP configuration beyond the predefined rules to better help you monitor and control the transmission of sensitive documents and messages outside of your network.
For example, many organizations use security classifications for documents and email messages. If the document or message is considered highly sensitive, it can contain special text that indicates that it is confidential and should not be communicated outside of your networks. The first line or header of a document or email message can include the classification text such as the phrase Classification: Confidential. You can use these classifications with a DLP custom rule to monitor your network traffic and make sure that sensitive documents and messages that contain these phrases do not leave your network.
The custom rule can contain multiple words and phrases that you want to monitor or control. You can then configure a DLP sensor to detect the custom rule and enable the DLP sensor for a policy.
Custom rules have these limitations:
To add a custom rule:
In the settings for a DLP sensor, you can enable a custom rule that contains the phrases to monitor and control. Then, you can enable the DLP sensor for each policy.
About Data Loss Prevention