Content Examination Definitions: Using Fuzzy Hashing

Document created by user.3AEuBpAOr2 Expert on Feb 2, 2016Last modified by user.Yo2IBgvWqr on Oct 6, 2017
Version 15Show Document
  • View in full screen mode

When configuring a Content Examination definition, you can:

  • Upload a control document. This must be created before adding to the definition.
  • Use fuzzy hashing to compare its content with the content inside attachments.
  • Determine the level of similarity expressed as a percentage.

 

Fuzzy hashes can be used in conjunction with other search terms (e.g. regular expressions, words, or phrases). See the Content Examination Definitions: Word /Phrase Match List Examples  page for further details.

 

Configuring a Fuzzy Hash Control Document

 

To configure a fuzzy hash control document to use with a Content Examination definition:

  1. Log on to the Administration Console.
  2. Click on the Administration menu item. A menu drop down is displayed.
  3. Click on the Gateway | Policies menu item.
  4. Hover over the Definitions button. A list of the definition types is displayed.
  5. Fuzzy Hashing DefinitionClick on the Content Examinations definition type from the list. The list of definitions is displayed.
  6. Click the Fuzzy Hash Definitions button.
  7. Click the Generate Fuzzy Hash button. The Fuzzy Hash Generation section is displayed.
  8. Complete the Fuzzy Hash Generation section as follows:
    Field / Option
    Description
    Description

    Specify a description for the file. The description is visible to administrators when viewing the definition, or selecting entries from the list of previously generated hash values.

    Fuzzy Hash TypeSpecify the type of fuzzy hash you would like to generate. The options are:
    • Mimecast Fuzzy Hash (MFH): This ignores any images in an attachment, basing it's similarity score on the attachment's text. With this option:
      • The control file must be a minimum file size of 4 KB.
      • All images should be removed from the control document to reduce the time taken to generate the fuzzy hash.
    • SSDEEP: This uses the entire attachment (including text and images) to determine how similar one file is to another.
    • Both: Both MFH and SSDEEP are used.
    New File Upload

    Click the Browse button to select the control document file. Only one file can be selected.

  9. Click on the Generate button.

 

Adding a Fuzzy Hash to a Content Examination Definition

 

Once you've created a fuzzy hash definition, you can add it to a Content Examination definition. This enables you to define the criteria that must be met before your configured actions take effect.

  1. Log on to the Administration Console.
  2. Click on the Administration menu item. A menu drop down is displayed.
  3. Click on the Gateway | Policies menu item.
  4. Hover over the Definitions button. A list of the definition types is displayed.
  5. Click on the Content Examinations definition type from the list. The list of definitions is displayed.
  6. Select a Folder in the hierarchy. Definitions cannot be placed in the "Root" folder.
  7. Either click on the:
    • Definition to be changed.
    • New Content Definition button to create a definition.
  8. To enter the fuzzy hash in the Word / Phrase Match List field:
    1. Click on the Insert | Fuzzy Hash menu item.
    2. Complete the Policy Definition dialog as follows:
      Field / OptionDescription
      Fuzzy Hash DefinitionClick on the Lookup button to display a list of all fuzzy hash files. Click on the Select link to the left of the fuzzy hash you wish to use.
      Line ScoreSpecify a value to assign to the fuzzy hash. This is measured against the definition's activation score.
      AppendThis controls where a fuzzy hash is placed in the "Word / Phrase Match List". If selected, the fuzzy hash is added to the bottom of the list. If disabled, the fuzzy hash is added to the top of the list.
    3. Click the Save and Exit button. The fuzzy hash and line score are displayed in the "Word / Phrase Match List".
  9. Click on the Fuzzy Hash Setting field to specify a similarity percentage value. This is applied to all the fuzzy hashes defined in the "Word / Phrase Match List".
  10. Click on the Save and Exit button.

 

See Also...

 

2 people found this helpful

Attachments

    Outcomes