Applies To: WatchGuard Data Control
You can use Data Control to search the contents of files. Searches can include both plain text and search parameters to narrow the results. The indexing process stores the text content of the file in a standard format, which Data Control uses to generate content searches.
Syntax Allowed in Quick Searches
Word: Search for "word" in the document content and metadata.
WordA WordB: Search for "worda" or "wordb" (logical operator OR) in the document content.
"WordA WordB": Search for "worda" and "wordb" consecutively in the document content.
+WordA +WordB: Search for "worda" and "wordb" in the document content.
+Worda -Wordb: Search for "worda" but not "wordb" in the document content.
Word*: Search for all words that start with "word". The wildcard "*" is only allowed at the end of the search term.
Wo?rd: Search for words that begin with "wo", end in "rd", and have a single character in between. The character "?" can be located at any point.
Word~: Search for all words that contain the string "word".
Syntax Allowed in Guided Searches
Guided searches do not allow "+" or "-". Instead, you enter search words in different text boxes. If you include the characters "+" or "-", they form part of the search term.
Personal Data Types Available
To narrow the results, Data Control supports the use of these qualifiers to indicate data types or file characteristics in quick and advanced searches:
- PiiType: Specifies the type of PII data detected in the file.
- HasPii: Indicates that the file has PII data.
- Filename: Indicates the name of the file.
- FileExtension: Indicates the file extension.
The values allowed in these parameters are:
- PiiType:BANKACCOUNT: Files that contain bank account details.
- PiiType:CREDITCARD: Files that contain credit card details.
- PiiType:IDCARD: Files that contain national ID card numbers (or similar).
- PiiType:SSN: Files that contain social security numbers.
- PiiType:IP: Files that contain IP addresses.
- PiiType:EMAIL: Files that contain email addresses.
- PiiType:PHONE: Files that contain phone numbers.
- PiiType:ADDRESS: Files that contain postal addresses.
- PiiType:FULLNAME: Files that contain first names and last names.
- PiiType:PASSPORT: Files that contain passport details.
- PiiType:DRIVERLIC: Files that contain driver's license details.
- HasPii:True: Files that contain PII data.
- Filename:"file name": Files with the specified file name.
- Fileextension: "file extension": Files with the specified file extension.
Syntax for PII Data Searches
You can use PII data types in all search types (quick or guided) , either alone or combined with other character strings. For example:
PiiType:IDCARD: Search for files with ID card data detected.
+PiiType:IDCARD +"WatchGuard": Search for files that contain a list of ID card details (with the character string "WatchGuard").
+Filename:scan* +fileextension:docx -PiiType:fullname: Search for scan files (files with a name that starts with "scan") in Word documents (.docx) that are not officially signed. For example, no Fullname (first and last names) was detected.
For more information, see How to Build Searches Compatible with the Normalization Process in Data Control.