1. Save it as an .xml file with Unicode encoding.
2. Connect to the Office 365 Security & Compliance Center using remote PowerShell
3. In the Security & Compliance Center PowerShell, type

   New- DlpSensitiveInformationTypeRulePackage -FileData (Get-Content -Path "C:\custompath\MyNewRulePack.xml" -Encoding Byte)

   Make sure that you use the file location where your rule pack is actually stored. C:\custompath\ is a placeholder.
4. To confirm, type Y, and then press ENTER.
5. Verify that your new sensitive information type was uploaded by typing Get- DlpSensitiveInformationType to see a list of all sensitive types. You can quickly separate custom sensitive information types from those which come built in by looking at the Publisher column. You can filter the list to a specific sensitive information type by running Get-DlpSensitiveInformationType -Identity “name of sensitive information type”.

I am going to show you here how to Export, import built-in rules and how to create a new custom rule using your own XML files.

Export the XML

You can export your rules from your tenant. If you don’t have a customized rule, you are going to see only the “Microsoft Rule Package”.

1. First, connect to the Exchange Online PowerShell:
   
   $Cred = Get-Credential
   $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $Cred -Authentication Basic –AllowRedirection
   Import-PSSession $Session
   
   
2. Just to check, you can list existing rules by typing:
   
   Get-ClassificationRuleCollection
   
   
   
   In my example, I have the default one and a Fingerprint rule that I uploaded before.
   
   
3. Store the rules in a variable:
   
   $ruleCollections = Get-ClassificationRuleCollection
   
   
4. Writes all the content to the XML file:
   
   Set-Content -path "C:\custompath\exportedRules.xml" -Encoding Byte -Value $ruleCollections.SerializedClassificationRuleCollection
   
   

You can check the exported content to understand the structure. I recommend you to use an XML editor:

Edit the XML file

Now you have the entire rule collection exported. It contains all default and customized rules (if you have one). You can check what you want to modify, if needed. This file can be used as a sample file to build your next DLP rules for your company.

The most important part in this file is the biggest one, the <Rules> part. For example, the Credit Card example below.

You might want to modify some parts, for example that requires corroborative evidence with different or additional keyword, adjust values such as proximity, add your own keywords etc.

Note: You will need to generate two GUIDs for your new rule (one for the rule package and one to replace the GUID used in the exported rule). You can create a new GUID in several ways, but you can use the PowerShell to simplify this task just typing [guid]::NewGuid() or if you want to create more than one you can use 1..4 | % {new-guid}, where 4 is the max number of GUIDs you want to create.

PowerShell References:

PowerTip: Create a New GUID by Using PowerShell
https://blogs.technet.microsoft.com/heyscriptingguy/2013/07/25/powertip-create-a-new-guid-by-using-powershell/

PowerTip: Use PowerShell to Create New GUID
https://blogs.technet.microsoft.com/heyscriptingguy/2015/09/10/powertip-use-powershell-to-create-new-guid/

Upload your new Rule

After the modifications you will need to upload your new rule. You can do this using PowerShell connected to Exchange Online.

1. First, save the file as XML ( use Unicode encoding – you need to use this encode to works)
   
   
2. Connect to Exchange Online Shell (explained earlier)
   
3. In the Exchange Shell Online, type:
   
   New-ClassificationRuleCollection -FileData (Get-Content -Path "C:\custompath\MyNewRulePack.xml" -Encoding Byte)
   
   
   
4. Run Get-DataClassification to retrieve the rule created

Remove Classification Rule Collection

If you want to remove this Classification Rule Collection you have created, you must type:

Remove-ClassificationRuleCollection -Identity "My New RulePack"

Creating a DLP policy and add the Rule created

Let’s now add the Classification Rule Collection we have created to a new policy.

First, you need to create a new DLP policy, for example:

New-DlpPolicy -Name "My New RulePack" -State Enabled -Description "My New Rule Pack - Contoso" -Mode Enforce

You can check your DLP policy by typing:

Get-DlpPolicy -Identity "My New RulePack"

Or go to Exchange admin center > data loss prevention:

Click to edit and go to rules. Select Create a new rule:

Let’s use an example here if the recipient is located Outside the organization and the message contains any of these types of sensitive information.

Now, select your rule pack created earlier and click to add.

Conclusion

You could read in this article how to export, import your custom rule and how to associate this to a new DLP Policy. You can edit your XML to add keywords and regular expressions to meet your organization’s specific needs. At the end you can test this rule sending an email to a recipient located outside your organization.

Reference:

Customize the built-in DLP sensitive information types
https://technet.microsoft.com/en-us/library/dn781122%28v=exchg.150%29.aspx?f=255&MSPPError=-2147217396

Links

Data loss prevention
https://technet.microsoft.com/EN-US/library/jj150527(v=exchg.150).aspx

How DLP rules are applied to evaluate messages
https://technet.microsoft.com/en-us/library/dn329050(v=exchg.150).aspx

DLP policy templates
https://technet.microsoft.com/en-us/library/jj657730(v=exchg.150).aspx

DLP procedures
https://technet.microsoft.com/en-us/library/jj938003(v=exchg.150).aspx

Policy Tips
https://technet.microsoft.com/en-us/library/jj150512(v=exchg.150).aspx

MVA Data loss prevention (DLP) in Office 365
https://mva.microsoft.com/en-US/training-courses/data-loss-prevention-in-office-365-8390?l=KgwSPyIz_2304984382

What the sensitive information types in Exchange look for
https://technet.microsoft.com/en-us/library/jj150541(v=exchg.150).aspx 

Videos

Data Loss Prevention (DLP) in Exchange, Outlook, and OWA
https://channel9.msdn.com/events/MEC/2014/EDC204

Data Loss Prevention in Office 365: Prevent That Oops Moment!
https://channel9.msdn.com/Events/TechEd/Europe/2014/OFC-B312

Data Loss Prevention (DLP) in Microsoft Office 365
https://channel9.msdn.com/Events/TechEd/NorthAmerica/2014/OFC-B319

Advanced Data Loss Prevention (DLP) in Exchange
https://channel9.msdn.com/events/MEC/2014/EDC302

Data Loss Prevention in Office 365: (01) Introduction to Data Loss Prevention in Office 365
https://channel9.msdn.com/Series/Data-Loss-Prevention-in-Office-365/01

Data Loss Prevention in Office 365: (02) End User Experience
https://channel9.msdn.com/Series/Data-Loss-Prevention-in-Office-365/02

Data Loss Prevention in Office 365: (03) DLP Policy Management Fundamentals
https://channel9.msdn.com/Series/Data-Loss-Prevention-in-Office-365/03

Data Loss Prevention in Office 365: (04) Under the Hood: Sensitive Content Detection
https://channel9.msdn.com/Series/Data-Loss-Prevention-in-Office-365/04

Data Loss Prevention in Office 365: (05) DLP Reporting and Customization
https://channel9.msdn.com/Series/Data-Loss-Prevention-in-Office-365/05

Customize and tune Microsoft Office 365 Data Loss Prevention
https://channel9.msdn.com/Events/Ignite/2016/BRK4001-TS

End-to-End Data Loss Prevention
https://channel9.msdn.com/Events/Ignite/2015/BRK3181

Protect your sensitive information with Office 365 Data Loss Prevention
https://myignite.microsoft.com/videos/1334

I hope you enjoy it!

What you need to know before?

It’s important to read and understand a little bit about DLP Policy Tips before. I’d like to share some basic links here about DLP and policy tips:

Data Loss Prevention
Policy Tips
Manage policy tips

Troubleshooting

Sometimes you create a DLP policy and associate a policy tip to it, and you realize that you cannot see it in Outlook, the policy doesn’t take effect in Outlook in Office 365.

First, it’s important to check that DLP is ON (by default, MailTips are turned on):

1. Open Outlook and select File > Options > Mail.

2. Under MailTips, click MailTips options.

3. Check that it’s not configured to Never Display. If you want to turn it off, select Never display MailTips.

If the tips are configured in Outlook and the issue persists, this problem occurs if the updated DLP policy wasn't downloaded to Outlook. Outlook checks for changes to DLP policies one time every 24 hours. What happens here is that you need to plan your DLP rules in advance, before put in production, you should expect some time to that the tips take effect.

However, it’s possible to force update the Policy Nudges as explained below:

Outlook 2013

1. In Registry Editor, locate the following subkeys:
HKEY_Current_User\Software\Microsoft\Office\15.0\Outlook\PolicyNudges
2. Delete the LastDownloadTimesPerAccount registry entry.
3. Exit Registry Editor.

Outlook 2016

1. In Registry Editor, locate the following subkeys:
HKEY_Current_User\Software\Microsoft\Office\16.0\Outlook\PolicyNudges
2. Delete the LastDownloadTimesPerAccount registry entry.
3. Exit Registry Editor.

If we clear the LastDownloadTimesPerAccount, we can force the server to push the newest set of policies.

Ensure that you have the latest build of Outlook from your portal.

Cmdlets

You can use the following cmdlets in order to set and create DLP Policy Tips:

Set-PolicyTipConfig
https://technet.microsoft.com/en-us/library/jj215660(v=exchg.160).aspx

New-PolicyTipConfig
https://technet.microsoft.com/en-us/library/jj215647(v=exchg.160).aspx

References

Outlook 2010, 2013, and 2016 MailTips Options

Changes to a data loss prevention policy don't take effect in Outlook 2013 in Office 365]]> https://docs.microsoft.com/archive/blogs/tiagosouza/hello-world Mon, 18 Jan 2016 01:38:24 GMT https://blogs.technet.microsoft.com/tiagosouza/?p=1 Welcome to my personal blog. I work from Microsoft as a Messaging PFE, focused on Exchange and Office 365 support. I want to share here some tips about troubleshooting, Exchange and Exchange online.