About custom content detectors

Supported editions for this feature: Frontline Standard and Frontline Plus; Enterprise Standard and Enterprise Plus; Education Fundamentals, Education Standard, and Education Plus; Enterprise Essentials Plus. Compare your edition

You use content detectors with data loss prevention (DLP) to specify sensitive content types to scan and report. If the prebuilt content detectors don't cover your needs, you can create your own custom content detector to be more specific. You can use a regular expression or comma-separated word list to specify the detector.

Content detectors don't guarantee detection of sensitive content. There are limitations with certain applications and file types.

Create a custom content detector

  1. In the Google Admin console, go to Menu and then Security and then Access and data control and then Data protection.

    Requires having the View DLP rule and Manage DLP rule administrator privileges.

  2. For Data protection rules and detectors, click Manage Detectors.
  3. Click Add detector and select a detector type:
    • Regular expression—A method for matching text with patterns
    • Word list—A custom list of specific words or phrases
  4. Enter the name and (optionally) a description for the detector.
  5. Provide the detection details based on your selection:
    • Regular expression—Enter an expression using Google RE2 syntax. For details, go to Examples of regular expressions. Click Test Expression to verify.
    • Word list—Enter a comma-separated word list. Capitalization and symbols are ignored. Only complete words are matched. Words must contain at least 2 alphanumeric characters.
  6. Click Create.
Changes can take up to 24 hours but typically happen more quickly. Learn more

View & manage existing detectors

  1. In the Google Admin console, go to Menu and then Security and then Access and data control and then Data protection.

    Requires having the View DLP rule and Manage DLP rule administrator privileges.

  2. For Data protection rules and detectors, click Manage Detectors.
  3. (Optional) To search for a detector:
    1. Click Add a filter.
    2. Select Detector name or Detector type.
    3. Specify the value to search for.
    4. Click Apply.
  4. (Optional) To export your rules to a text file, click Export detectors and specify the file name and location.
  5. Click the detector name to edit it. When you edit detectors that are used in rules, it triggers a new scan on all documents affected by those rules.
  6. (Optional) To delete a detector, at the end of the detector's row, click Delete . Deleting detectors is permanent and cannot be undone.
Changes can take up to 24 hours but typically happen more quickly. Learn more

Example: Protect internal names using a custom word list

In this example, you prevent users from sharing files with external recipients if the contents contain an internal project name. You first create a custom word list detector and then add it to a data protection rule.

Step 1: Create the word list detector

  1. In the Google Admin console, go to Menu and then Security and then Access and data control and then Data protection.

    Requires having the View DLP rule and Manage DLP rule administrator privileges.

  2. For Data protection rules and detectors, click Manage Detectors and then Add detector and then Word list.
  3. For Name, enter Internal Project Names.
  4. Enter the following comma-separated words: SpiderWeb, SpdW, TestingSpdW
    • Capitalization is ignored. SpiderWeb matches spiderweb, Spiderweb, and SPIDERWEB.
    • Only complete words are matched. Spider will not match SpiderWeb.
  5. Click Create.

Step 2: Create the data protection rule

  1. For Data protection rules and detectors, click Manage Rules and then Add rule and then New rule.
  2. For Name, enter Block sharing of internal project names.
  3. For Apps, select:
    • Google Chat and then File uploaded.
    • Google Drive and then Drive files.
  4. Click Continue.
  5. For Actions, complete the following steps:
    • For Google Chat, select Block message. Check the External conversations box and uncheck the Internal conversations box.
    • For Google Drive, select Block external sharing.
  6. For Alerting, select High and check the Alert center and All super admins boxes.
  7. Click Continue.
  8. For Scope, select All in domain.name.
  9. For Content conditions, click Add Condition and select the following parameters:
    • Content type to scan—All content
    • What to scan for—Matches word from word list
    • Word list name—Internal Project Names
    • Match mode—Match any word
    • Minimum total times any word detected—1
  10. Click Continue and review the rule details.
  11. Click Create.
Changes can take up to 24 hours but typically happen more quickly. Learn more