Policy Guide › Data Lookup › User Attribute Lookup › User Attribute Lookup Examples

User Attribute Lookup Examples

These examples refer to emails sent internally within an organization. User Attribute lookup does not detect emails sent to or from external addresses. These examples assume that the custom attributes 'Team' and 'Rank' have been defined for the CA DLP users in your organization.

• This example detects all outgoing emails where one or more recipients is in the Equity Markets team. If CA DLP detects such a recipient, that user’s name and team are written to the %which_guy% and %proscribed_team% variables respectively. You can then incorporate these variables in a user notification message:

  userattr WITH any %recipient% labeled %which_guy% 
  WHERE Team labeled %proscribed_team% IS "Equity Markets" 
  

• This example detects all outgoing emails where a recipient is a member of teams such as Equity Markets or Debt Markets:

  userattr WITH any %recipient% WHERE Team CONTAINS ANY {"Equity","Debt"} 
  

• This example detects all outgoing emails where recipients include any junior ranking staff (in this case, ‘Non-officers’):

  userattr WITH any %recipient% WHERE Rank CONTAINS ALL {"non","officer"}
  

• This example detects all outgoing emails that do not include a director in the list of recipients:

  userattr WITH all %recipient% WHERE Rank EXCLUDES "director"
  

• This example detects all outgoing emails where the recipient list excludes an executive director in the Equity Markets team. That is, the command returns a True value (and activates the control trigger) if no such recipient is detected.

  Note the NOT operator! The NOT operator ensures that if an executive director in the Equity Markets team is detected, the command returns a False value (and the trigger does not activate). The mandatory keyword ensures that, if no Rank is specified, the data lookup command fails and invokes the Data Lookup Failure Mode.

  userattr WITH all %recipient%
   WHERE 
    (Team IS NOT "Equity Markets") 
   AND 
    (mandatory Rank IS NOT {"executive","director"}) 
  

• This example combines Message Attribute and User Attribute lookup commands to detect emails sent to members of any securities team where the total message impact exceeds 1MB:

  (msgattr WHERE msgimpactkb > 1000) AND (userattr WITH any %recipient% 
  WHERE Team CONTAINS "Securities")