What the sensitive information types in SharePoint Server 2016 look for

9 digits which may be in a formatted or unformatted pattern

Formatted:

• Four digits beginning with 0, 1, 2, 3, 6, 7, or 8

• A hyphen

• Four digits

• A hyphen

• A digit

Unformatted:

• 9 consecutive digits beginning with 0, 1, 2, 3, 6, 7, or 8

No

A DLP policy is 75% confident that it's detected this type of sensitive information if, within a proximity of 300 characters:

• The function Func_aba_routing finds content that matches the pattern.

• A keyword from Keyword_ABA_Routing is found.

<!-- ABA Routing Number -->
<Entity id="cb353f78-2b72-4c3c-8827-92ebe4f69fdf" patternsProximity="300" recommendedConfidence="75">
      <Pattern confidenceLevel="75">
        <IdMatch idRef="Func_aba_routing" />
        <Match idRef="Keyword_ABA_Routing" />
      </Pattern>
 </Entity>

16 digits which can be formatted or unformatted (dddddddddddddddd) and must pass the Luhn test.

Very complex and robust pattern that detects cards from all major brands worldwide, including Visa, MasterCard, Discover Card, JCB, American Express, gift cards, and diner cards.

Yes, the Luhn checksum

A DLP policy is 85% confident that it's detected this type of sensitive information if, within a proximity of 300 characters:

• The function Func_credit_card finds content that matches the pattern.

• One of the following is true:

  • A keyword from Keyword_cc_verification is found.

  • A keyword from Keyword_cc_name is found.

  • The function Func_expiration_date finds a date in the right date format.

• The checksum passes.

A DLP policy is 65% confident that it's detected this type of sensitive information if, within a proximity of 300 characters:

• The function Func_credit_card finds content that matches the pattern.

• The checksum passes.

<!-- Credit Card Number -->
<Entity id="50842eb7-edc8-4019-85dd-5a5c1f2bb085" patternsProximity="300" recommendedConfidence="85">
  <Pattern confidenceLevel="85">
        <IdMatch idRef="Func_credit_card" />
        <Any minMatches="1">
          <Match idRef="Keyword_cc_verification" />
          <Match idRef="Keyword_cc_name" />
          <Match idRef="Func_expiration_date" />
        </Any>
  </Pattern>
  <Pattern confidenceLevel="65">
        <IdMatch idRef="Func_credit_card" />
  </Pattern>
</Entity>

16 digits

Very complex and robust pattern

Yes

A DLP policy is 85% confident that it's detected this type of sensitive information if, within a proximity of 300 characters:

• The function Func_eu_debit_card finds content that matches the pattern.

• At least one of the following is true:

  • A keyword from Keyword_eu_debit_card is found.

  • A keyword from Keyword_card_terms_dict is found.

  • A keyword from Keyword_card_security_terms_dict is found.

  • A keyword from Keyword_card_expiration_terms_dict is found.

  • The function Func_eu_date1 finds a date in the right date format.

  • The function Func_eu_date2 finds a date in the right date format.

• The checksum passes.

<!-- EU Debit Card Number -->
<Entity id="0e9b3178-9678-47dd-a509-37222ca96b42" patternsProximity="300" recommendedConfidence="85">
  <Pattern confidenceLevel="85">
        <IdMatch idRef="Func_eu_debit_card" />
        <Any minMatches="1">
          <Match idRef="Keyword_eu_debit_card" />
          <Match idRef="Keyword_card_terms_dict" />
          <Match idRef="Keyword_card_security_terms_dict" />
          <Match idRef="Keyword_card_expiration_terms_dict" />
          <Match idRef="Func_expiration_date" />
          <Match idRef="Func_eu_date" />
          <Match idRef="Func_eu_date1" />
          <Match idRef="Func_eu_date2" />
        </Any>
  </Pattern>
</Entity>

Four letters followed by 5-31 letters or digits

Four letters followed by 5-31 letters or digits:

• Four-letter bank code (not case sensitive)

• An optional space

• 4-28 letters or digits (the Basic Bank Account Number (BBAN))

• An optional space

• 1-3 letters or digits (remainder of the BBAN)

No

A DLP policy is 75% confident that it's detected this type of sensitive information if, within a proximity of 300 characters:

• The regular expression Regex_swift finds content that matches the pattern.

• A keyword from Keyword_swift is found.

<Entity id="cb2ab58c-9cb8-4c81-baf8-a4e106791df4" patternsProximity="300" recommendedConfidence="75">
<Pattern confidenceLevel="75">
        <IdMatch idRef="Regex_swift" />
        <Match idRef="Keyword_swift" />
    </Pattern>
</Entity>

7 characters or 9 characters separated by spaces or dashes

Two possible patterns:

• Two letters (valid NINOs use only certain characters in this prefix, which this pattern validates; not case sensitive)

• Six digits

• Either 'A', 'B', 'C', or 'D' (like the prefix, only certain characters are allowed in the suffix; not case sensitive)

OR

• Two letters

• A space or dash

• Two digits

• A space or dash

• Two digits

• A space or dash

• Two digits

• A space or dash

• Either 'A', 'B', 'C', or 'D'

No

A DLP policy is 85% confident that it's detected this type of sensitive information if, within a proximity of 300 characters:

• The function Func_uk_nino finds content that matches the pattern.

• A keyword from Keyword_uk_nino is found.

A DLP policy is 75% confident that it's detected this type of sensitive information if, within a proximity of 300 characters:

• The function Func_uk_nino finds content that matches the pattern.

• No keyword from Keyword_uk_nino is found.

<!-- U.K. NINO -->
<Entity id="16c07343-c26f-49d2-a987-3daf717e94cc" patternsProximity="300" recommendedConfidence="75">
    <Pattern confidenceLevel="85">
        <IdMatch idRef="Func_uk_nino" />
        <Any minMatches="1">
          <Match idRef="Keyword_uk_nino" />
        </Any>
    </Pattern>    
     <Pattern confidenceLevel="75">
        <IdMatch idRef="Func_uk_nino" />
        <Any minMatches="0" maxMatches="0">
          <Match idRef="Keyword_uk_nino" />
        </Any>
    </Pattern>
</Entity>

Nine digits

Nine consecutive digits

No

A DLP policy is 75% confident that it's detected this type of sensitive information if, within a proximity of 300 characters:

• The function Func_usa_uk_passport finds content that matches the pattern.

• A keyword from Keyword_passport is found.

<Entity id="178ec42a-18b4-47cc-85c7-d62c92fd67f8" patternsProximity="300" recommendedConfidence="75">
    <Pattern confidenceLevel="75">
        <IdMatch idRef="Func_usa_uk_passport" />
        <Match idRef="Keyword_passport" />
    </Pattern>
</Entity>

4-17 digits

4-17 consecutive digits

No

A DLP policy is 75% confident that it's detected this type of sensitive information if, within a proximity of 300 characters:

• The regular expression Regex_usa_bank_account_number finds content that matches the pattern.

• A keyword from Keyword_usa_Bank_Account is found.

<!-- U.S. Bank Account Number -->
<Entity id="a2ce32a8-f935-4bb6-8e96-2a5157672e2c" patternsProximity="300" recommendedConfidence="75">
    <Pattern confidenceLevel="75">
        <IdMatch idRef="Regex_usa_bank_account_number" />
        <Match idRef="Keyword_usa_Bank_Account" />
    </Pattern>
</Entity>

Depends on the state

Depends on the state -- for example, New York:

• Nine digits formatted like ddd ddd ddd will match.

• Nine digits like ddddddddd will not match.

No

A DLP policy is 75% confident that it's detected this type of sensitive information if, within a proximity of 300 characters:

• The function Func_new_york_drivers_license_number finds content that matches the pattern.

• A keyword from Keyword_[state_name]_drivers_license_name is found.

• A keyword from Keyword_us_drivers_license is found.

A DLP policy is 65% confident that it's detected this type of sensitive information if, within a proximity of 300 characters:

• The function Func_new_york_drivers_license_number finds content that matches the pattern.

• A keyword from Keyword_[state_name]_drivers_license_name is found.

• A keyword from Keyword_us_drivers_license_abbreviations is found.

• No keyword from Keyword_us_drivers_license is found.

    <Pattern confidenceLevel="75">
        <IdMatch idRef="Func_new_york_drivers_license_number" />
        <Match idRef="Keyword_new_york_drivers_license_name" />
        <Match idRef="Keyword_us_drivers_license" />
    </Pattern>
    <Pattern confidenceLevel="65">
        <IdMatch idRef="Func_new_york_drivers_license_number" />
        <Match idRef="Keyword_new_york_drivers_license_name" />
        <Match idRef="Keyword_us_drivers_license_abbreviations" />
        <Any minMatches="0" maxMatches="0">
          <Match idRef="Keyword_us_drivers_license" />
        </Any>
    </Pattern>

Nine digits that start with a "9" and contain a "7" or "8" as the fourth digit, optionally formatted with spaces or dashes

Formatted:

• The digit "9"

• Two digits

• A space or dash

• A "7" or "8"

• A digit

• A space, or dash

• Four digits

Unformatted:

• The digit "9"

• Two digits

• A "7" or "8"

• Five digits

No

A DLP policy is 85% confident that it's detected this type of sensitive information if, within a proximity of 300 characters:

• The function Func_formatted_itin finds content that matches the pattern.

• At least one of the following is true:

  • A keyword from Keyword_itin is found.

  • The function Func_us_address finds an address in the right date format.

  • The function Func_us_date finds a date in the right date format.

  • A keyword from Keyword_itin_collaborative is found.

A DLP policy is 75% confident that it's detected this type of sensitive information if, within a proximity of 300 characters:

• The function Func_unformatted_itin finds content that matches the pattern.

• At least one of the following is true:

  • A keyword from Keyword_itin_collaborative is found.

  • The function Func_us_address finds an address in the right date format.

  • The function Func_us_date finds a date in the right date format.

<!-- U.S. Individual Taxpayer Identification Number (ITIN) -->
<Entity id="e55e2a32-f92d-4985-a35d-a0b269eb687b" patternsProximity="300" recommendedConfidence="75">
    <Pattern confidenceLevel="85">
        <IdMatch idRef="Func_formatted_itin" />
        <Any minMatches="1">
          <Match idRef="Keyword_itin" />
          <Match idRef="Func_us_address" />
          <Match idRef="Func_us_date" />
          <Match idRef="Keyword_itin_collaborative" />
        </Any>
    </Pattern>
    <Pattern confidenceLevel="75">
        <IdMatch idRef="Func_unformatted_itin" />
        <Match idRef="Keyword_itin" />
        <Any minMatches="1">
          <Match idRef="Keyword_itin_collaborative" />
          <Match idRef="Func_us_address" />
          <Match idRef="Func_us_date" />
        </Any>
    </Pattern>
</Entity>

9 digits, which may be in a formatted or unformatted pattern

Four functions look for SSNs in four different patterns:

• Func_ssn finds SSNs with pre-2011 strong formatting that are formatted with dashes or spaces (ddd-dd-dddd OR ddd dd dddd)

• Func_unformatted_ssn finds SSNs with pre-2011 strong formatting that are unformatted as nine consecutive digits (ddddddddd)

• Func_randomized_formatted_ssn finds post-2011 SSNs that are formatted with dashes or spaces (ddd-dd-dddd OR ddd dd dddd)

• Func_randomized_unformatted_ssn finds post-2011 SSNs that are unformatted as nine consecutive digits (ddddddddd)

No

A DLP policy is 85% confident that it's detected this type of sensitive information if, within a proximity of 300 characters:

• The function Func_ssn finds content that matches the pattern.

• At least one of the following is true:

  • A keyword from Keyword_ssn is found.

  • The function Func_us_date finds a date in the right date format.

  • The function Func_us_address finds an address in the right date format.

A DLP policy is 75% confident that it's detected this type of sensitive information if, within a proximity of 300 characters:

• The function Func_unformatted_ssn finds content that matches the pattern.

• A keyword from Keyword_ssn is found.

• At least one of the following is true:

  • The function Func_us_date finds a date in the right date format.

  • The function Func_us_address finds an address in the right date format.

A DLP policy is 65% confident that it's detected this type of sensitive information if, within a proximity of 300 characters:

• The function Func_randomized_formatted_ssn finds content that matches the pattern.

• The function Func_ssn does not find content that matches the pattern.

• At least one of the following is true:

  • A keyword from Keyword_ssn is found.

  • The function Func_us_date finds a date in the right date format.

  • The function Func_us_address finds an address in the right date format.

A DLP policy is 55% confident that it's detected this type of sensitive information if, within a proximity of 300 characters:

• The function Func_randomized_unformatted_ssn finds content that matches the pattern.

• A keyword from Keyword_ssn is found.

• The function Func_unformatted_ssn does not find content that matches the pattern.

• At least one of the following is true:

  • The function Func_us_date finds a date in the right date format.

  • The function Func_us_address finds an address in the right date format.

<!-- U.S. Social Security Number (SSN) -->
<Entity id="a44669fe-0d48-453d-a9b1-2cc83f2cba77" patternsProximity="300" recommendedConfidence="75">
    <Pattern confidenceLevel="85">
        <IdMatch idRef="Func_ssn" />
        <Any minMatches="1">
          <Match idRef="Keyword_ssn" />
          <Match idRef="Func_us_date" />
          <Match idRef="Func_us_address" />
        </Any>
    </Pattern>
    <Pattern confidenceLevel="75">
        <IdMatch idRef="Func_unformatted_ssn" />
        <Match idRef="Keyword_ssn" />
        <Any minMatches="1">
          <Match idRef="Func_us_date" />
          <Match idRef="Func_us_address" />
        </Any>
    </Pattern>
    <Pattern confidenceLevel="65">
        <IdMatch idRef="Func_randomized_formatted_ssn" />
        <Any minMatches="0" maxMatches="0">
          <Match idRef="Func_ssn" />
        </Any>
        <Any minMatches="1">
          <Match idRef="Keyword_ssn" />
          <Match idRef="Func_us_date" />
          <Match idRef="Func_us_address" />
        </Any>
    </Pattern>
    <Pattern confidenceLevel="55">
        <IdMatch idRef="Func_randomized_unformatted_ssn" />
        <Match idRef="Keyword_ssn" />
        <Any minMatches="0" maxMatches="0">
          <Match idRef="Func_unformatted_ssn" />
        </Any>
        <Any minMatches="1">
          <Match idRef="Func_us_date" />
          <Match idRef="Func_us_address" />
        </Any>
    </Pattern>
</Entity>