Policy Guide › Data Lookup › User Attribute Lookup › User Attribute Lookup Syntax

User Attribute Lookup Syntax

User Attribute lookups can detect emails sent to or from CA DLP users with attributes. A syntax summary and brief examples are given below.

Note: CA DLP triggers detect emails sent to or from non- CA DLP users by the absence of a specific user attribute.

Important! Before you can use User Attribute lookup commands, you must configure the corresponding settings in the machine policy.

Simple Commands

These commands test a simple True or False statement relating to a single user attribute of the email recipients or sender. For example, if a 'Team' attribute has been created for your organization, you can define a command to test whether any email recipients are members of a specific team. The syntax is:

userattr WITH <who> [labeled <fallguy>] WHERE <uservar> [labeled <offlimits>] 
  <stringoperator> <text>

The simple example below detects all outgoing emails where any of the recipients are members of the equity markets team:

userattr WITH any %recipient% WHERE Team IS "Equity Markets"

Complex Commands

More complex commands can include AND, OR and NOT operators to combine multiple True or False tests. For example, if 'Team' and 'Rank' attributes have been created for your organization, you can define a command to test whether an email's recipients include a manager in the equity markets team.