Sensitive Content Detection Rule
Download
フォーカスモード
フォントサイズ
After you enable the sensitive content detection rules, the system scans the request and response content flowing through APIs (covering locations such as headers, body, query, cookie, and response). It identifies whether this content contains Personally Identifiable Information (PII) and sensitive credentials, such as ID card numbers, phone numbers, bank card numbers, and keys. Upon a match, the system applies a sensitive Tag to the API asset and generates a risk event.
Enabling System-Built-in Rules
On the API Security > Rule Configuration > Sensitive Content Detection Rule page, after you enable the sensitive content detection rules, the system enables the built-in rules by default to detect whether API assets contain sensitive data. The built-in rules can be enabled or disabled, but they cannot be edited or deleted. The platform provides a set of built-in rules, which can identify 19 types of sensitive data by default. These rules are enabled by default and cannot be edited.
Adding Custom Rule
After you enable the sensitive content detection rules, you can customize sensitive detection rules based on your business needs. You can flexibly define the detection scope using keywords, character patterns, or regular expressions according to your requirements.
Note:
A maximum of 20 custom sensitive content detection rules can be manually added to a single domain.
1. On the API Security > Rule Configuration > Sensitive Content Detection Rule page, click Add Rule.
2. In the Add Rule window, configure the relevant parameters and click OK to create the rule.
3. After you add a rule, you can edit or delete the corresponding rule.
Configuration Item Description
Rule name: Supports custom input, does not allow duplicates, and is recommended to be prefixed with a domain name or API path. The maximum length is 128 characters.
Parameter Location: Supports detection across multiple locations, including headers, body, query, cookie, and response.
Condition && Content
Match by keyword: Detects whether keywords are contained. When you select keyword matching, you can choose to Include any (OR) Include all (AND) of the keywords. Enter multiple keywords by pressing Enter. You can enter a maximum of 20 keywords.
Character matching: Detects the length range of the content and whether it consists of specific character types. When you select Character matching, you can choose from three character types: Lowercase letters, Uppercase letters and Digit. Multiple selections are allowed. After selection, enter the character length range, with a minimum of 6 characters and a maximum of 128 characters.
Regex match: Detects whether content matches specific regular expressions. When you select Regex match, you can enter multiple regular expressions by pressing Enter for matching. You can enter a maximum of 20 regular expressions.
Parameter Generalization: After you select generalization, the corresponding parameter value in the API asset parameter sample will display the generalized data.
Risk Level: Supports selection of ultra-high-risk, high-risk, medium-risk, and low-risk to indicate the risk level of corresponding security events.
On/Off: Controls whether to enable or disable this rule. The default setting is On.
Configuration Example
Configuration scenario: The business prohibits carrying sensitive
user_id content. Assets containing sensitive content are detected to drive internal remediation.
Configuration effect: If a request carries sensitive information, the system applies a sensitive Tag to the asset. If a related data leakage risk is detected, the system generates an API risk event.
フィードバック