Skip to content

Creating a Behavioral-based Classification Rule

Note

You must enable the “Classify behavioral rules” task in order to run behavioral-based rules.

In the process of creating a behavioral-based classification rule, File Access Manager performs an AND operation between the expressions. However, some operators act as an internal OR (for example, the IN operator).

To create a Behavioral-based rule:

  1. Open the rules page by navigating to Compliance > Data Classification > Rules

  2. Select + New Rule > Behavioral Based Rule.

    The available Behavioral-based Rule fields include:

    • Rule Name - Rule names are unique. It is best to create a naming convention that avoids using the same name twice.

    • Categories - Enter one or more categories for the rule. To add a new category to the Categories list, select Manage Categories and add a new item.

    • Behavioral Requirements for Rule - Specifies the threshold and timeframe for categorizing BRs according to the users accessing these files.
      Example threshold configuration: “at least 25% of the users with activities on files in this folder are members of the Finance department.”

  3. Define the timeframe and required usage:

    • Value - Percentage required to meet the rule.
    • Timeframe - The timeframe during which to check the rule.

  4. In the Rule Criteria section, add the general details to the Behavioral-based Classification rule.

  5. Select an Attribute, an Operator, and a Value (optional) from the dropdown menus.

  6. Create an expression and select Save.

    Note

    Users can edit or delete existing rule criteria.

  7. Add additional rule requirements as needed.

  8. Select Save to save the new behavioral-based rule. The system adds the rules to the Rules list.

Scheduling Classify Behavioral Rules Task

The Classify Behavioral Rules task is a global scheduled task. It is created out of the box, and is disabled by default. This task runs on all scope on supported applications.

All applications, besides the ones listed below, support the classify behavioral rules task.

File Extension Expected file type
NFS (Generic) No activities
CIFS (Generic) No activities
Generic database table No file, but if one is added it will work
SQL Server DB No file
AD No file
DFS No activities
Home-Grown No activities
NFS (Generic) No activities

To schedule the Classify Behavioral Rules task:

  1. Navigate to Settings > Task Management > Scheduled Tasks.
  2. Select the task Classify Behavioral Rules on the Scheduled Tasks table on the tickbox on the task row. This will open the options buttons.
  3. Select Edit to open the scheduling edit panel.
  4. Set the task to active / inactive.
  5. Change the scheduling parameters as required.