Keyword Lists

Updated 4 months ago by admin

Keyword Lists are user-created collections of keywords patterns, which can be used to identify URLs and App Content as part of the Keyword Category Match in Filter Rules. Typically, Keyword Lists are used to perform wildcard blocking on URLs, to block certain words used on Social Media or to the block file extensions. Keyword Lists provide extreme flexibility when used in conjunction with Filter Rules.

Managing Keyword Lists

To access Keyword Lists, visit your USS Dashboard, and click Products ⟶ Settings ⟶ Keyword Lists

The Keyword Lists screen displays all of your current Keyword Lists on the left. You can expand any list by selecting it. The individual keyword patterns in the list will then be displayed on the right.

Searching Keyword Lists

You can locate a specific keyword pattern using the Search bar.

Enter your search query and click (or just hit `Enter`). The Keyword Lists will now only show Lists containing a keyword pattern that matches your search query.

To return to the full list of Keywords, just click the button.

Adding a new Keyword List

To add a new Keyword List, click the button, and enter the details in the form that's displayed.

Name

The name of the new List. This name will be shown in Reports for web requests that match the Category, and in Charts and the Filter Rules interface when selecting Keyword Categories as a Match.

Match Logic

When used in a Filter Rule, whether this List uses OR logic (any one keyword in the List must match), or AND logic (all keyword in the List must match).

Match Content

Whether the keyword patterns in this List should apply only to URLs, only to Intercepted App Action, or to both. The Intercepted App Action is the data available in the Action Value column of the App Analyse report (requires a valid Cloud Application Control license).

DLP Content

Mark this Keyword List as containing potential Data Loss Prevention content. Selecting this checkbox will make the Keyword List available for selection in the Keyword Lists section of the Cloud Application Security product.

Click to create the new Keyword Category.

Updating Keyword Lists

To edit a Keyword List, simply double-click it. Once you've made any required changes, click to save the changes.

Deleting Keyword Lists

Removing a Keyword List will remove it from any Rules that reference the List and will also remove all the keyword patterns that belong to the List.

To delete an existing Keyword List, select it and then click the button.

Managing Patterns

In the context of Keyword Lists, patterns simply represent words. Each word can have a match type. Together with the Block Logic Category level setting, this determines how the patterns will be applied by the Rules engine when used in a Filter Rule.

Adding Patterns

To add a new Keyword Pattern, first select the Keyword List to which the new Pattern should belong. Then, click the button and enter the details in the form that's displayed.

Take care when adding keyword patterns that apply to URLs. It is very easy to create a false positive if due care is not taken.
Pattern

The pattern to match against. Patterns should be simple, but not so generic that you risk creating false positives.

Take care when choosing your patterns, and avoid common words like "and" or common word endings like "ing".
Match Type

The type of matching to apply to the pattern.

The "Does Not Match" option is only available if the List Block Logic is "Match All Patterns" and there is at least one other pattern in the List.

Comment

An optional short description or explanation of the keyword pattern.

Matching patterns in Captured App Content cannot be guaranteed as it depends on the format the third-party Cloud App uses. It is recommended that you experiment to ensure the patterns meet your requirements.

Click to create the new Keyword Pattern.

Updating Patterns

To edit a Pattern, double-click it. Make the changes you require, and then click .

Deleting Patterns

To delete a Pattern, select it and click the button.

Using Keyword Lists in Rules

Keyword Lists can be used within Filter Rules in order to match web requests. For example, you may want to block specific words on Social Media or block URLs ending with certain file extensions.


How did we do?