Skip to main content

DLP tester

The DLP tester screen lets you run the data loss prevention engine on a text (detect, mask, tokenize or block) and manage the custom rules of your tenant. Portal path: /data/dlp. Security officers and tenant administrators use it to tune the rules; developers use it to check what a prompt or a document will look like after filtering.

What the screen shows​

The Tester section holds a text area prefilled with a sample text (name, e-mail, phone number, IBAN), a mode selector and the Run button. The modes are Detect, Mask, Tokenize and Block.

The result panel shows:

  • a red banner "Blocked: the content contains data that cannot leave the platform." when the result is blocked;
  • the transformed text (masked or tokenized);
  • the Classification badge computed from the findings;
  • one badge per finding with its type and score, or "No sensitive data found";
  • Raw response, the full JSON answer (text, findings, action, classification, mode, engine, blocked, count).

The Custom DLP rules table lists the rules of the tenant: Name, Entity type, Pattern, Action, Classification, Enabled. The built in detectors are always active; custom rules add your own identifiers.

The New rule form has Name (required), Entity type (example credit_card), Pattern (regular expression, example EMP-[0-9]{6}), Action (required: mask, block, tokenize, allow), Classification (confidential, internal, restricted, secret) and Minimum score (0.5).

Actions​

Button or actionWhat it doesAPI callRoles
Run with DetectFinds the sensitive data without changing the textPOST /v1/dlp/inspectany tenant user
Run with Mask, Tokenize or BlockApplies the mode to the textPOST /v1/dlp/redactany tenant user
Refresh iconReloads the rulesGET /v1/dlp/rulesany tenant user
New rule > CreateCreates the rule, or updates the rule with the same namePOST /v1/dlp/rulestenant_admin, security_officer

Roles​

The portal shows every button to every user. The Control Plane (services/control-plane/src/eai/domains/privacy/__init__.py) lets any user of the tenant run the tester and read the rules; each test is audited as dlp.inspect or dlp.redact. Creating or changing a rule needs tenant_admin or security_officer.

Typical tasks​

Check what a text becomes after filtering​

  1. Paste the text. The tester uses the same engine and rules as the gateway. Replace the sample text with yours.

    Expected result: the Run button is enabled.

    If it fails: the button stays disabled while the text is empty.

  2. Run the mode. Choose Mask, then click Run.

    Expected result: the masked text, the classification and one badge per finding.

    If it fails: open Raw response to read the engine used and the exact findings.

Add a rule for an internal identifier​

  1. Create the rule. Built in detectors do not know your employee or contract numbers. Click New rule, fill Name, Pattern (for example EMP-[0-9]{6}), Action mask and Classification, then Create.

    Expected result: the toast "Created" and the rule in Custom DLP rules with Enabled set.

    If it fails: invalid_request with pattern means the regular expression does not compile.

  2. Test it. Type a text containing such an identifier in the tester and click Run with Detect.

    Expected result: a badge of the new entity type.

    If it fails: raise or lower Minimum score of the rule.

Troubleshooting​

SymptomCauseFix
forbidden (403) on CreateYou are neither tenant_admin nor security_officerAsk a security officer to create the rule
invalid_request (400) with required entity_type, patternThe rule has neither an entity type nor a patternFill at least one of them
invalid_request (400) with patternThe regular expression is invalidFix the expression (escape the special characters)
invalid_request (400) with actionUnknown actionUse allow, detect, mask, tokenize or block
invalid_request (400) with classificationUnknown classificationUse one of the listed values
tenant_required (403)Your session has no tenantSign in with an account of a tenant