Internal project codenames follow a fixed pattern of two capital letters, a hyphen and four digits, and no built-in data identifier in Cisco Secure Access matches them. The team wants DLP rules to detect these codenames in web uploads. What should be configured?

DLP rules in Cisco Secure Access do not reference identifiers directly; they reference data classifications, which group one or more data identifiers. Built-in identifiers cover common sensitive types such as financial account numbers, government identifiers and health information. Organization-specific content needs a custom identifier, which can be built from a regular expression pattern such as the codename format, and then added to a classification that a real-time or SaaS API rule selects. A lowered threshold on the built-in PII classification changes how many matches of known PII types are required; it does not teach the engine a new pattern, and it raises false positives on the data it already detects. Blocking a whole content category of file-sharing sites is a blunt access control: it does not detect codenames, it does nothing for uploads to other destinations, and it disrupts legitimate use. A destination list contains domains and addresses, so placing codename strings in it and attaching it to DNS policy would match hostnames, not the content of uploads. Exam caveat: exclusion identifiers can be added to a classification to reduce false positives, and exclusion takes precedence over inclusion. Operational check: upload a test document containing a sample codename and confirm that the rule logs a match against the custom identifier.