Social Security rule Help

Question

Hello all,
Not sure if this is every company, but we have pretty strict rules for SSN's. We use the C150. We have the following rule to catch the main SSN offensives and this works very well.
ssn: if (recv-listener == 'OutboundMail') AND body-contains("\\b[0-9]{9}\\b|\\b[0-9]{3}[-]+[0-9]{2}[-]+[0-9]{4}\\b|\\b[0-9]{3}[\\t]*[0-9]{2}[ \\t]*[0-9]{4}\\b|\\b[0-9]{3}[,]+[0-9]{2}[,]+[0-9]{4}\\b|\\b[0-9]{3}[;]+[0-9]{2}[;]+[0-9]{4}\\b|\\b[0-9]{3}[:]+[0-9]{2}[:]+[0-9]{4}\\b|\\b[0-9]{3}[.]+[0-9]{2}[.]+[0-9]{4}\\b|\\b[0-9]{8}\\b", 1)
But, we actually need to catch 9 digit numbers also such as 555555555. We are having a lot of problems with this rule and making it work good. So far, we have caught ticket numbers, HTML font classes, Outlook meetings, etc. I know this is going to be a tough rule, but wondering if anyone else had luck making one work. This one seems to catch 9 digit numbers if there is a letter on either side or more than a 9 digit number, but not if it has a hypen, period, comma, etc on either side.
ssn_8_or_9_digit: if (recv-listener == "OutboundMail") AND (body-contains("([^\\w=-@:]|^)\\b[0-9]{9}\\b([^\\w=-@:]|$), 1)
Please let me know if anyone has luck.

Answer 1

In version 6.1 (or above?)
Smart Identifiers
When you use message rules that scan message content, you can use smart identifiers to detect certain patterns in the data.
Smart identifiers can detect the following patterns in data:
• Credit card numbers
• U.S. Social Security numbers
• CUSIP (Committee on Uniform Security Identification Procedures) numbers
• ABA (American Banking Association) routing numbers
To use smart identifiers in a filter, enter the following keywords in a filter rule that scans body or attachment content:
Syntax
When you use a smart identifier in a filter rule, enter the smart-identifier keyword in quotes within a filter rule that scans the body or attachment file, as in the example below:
CHAPTER 4: POLICY ENFORCEMENT 171
You can also use smart identifiers in content filters and as a part of content dictionaries.
Note — You cannot combine a smart identifier key word with a normal regular expression or another key word. For example the pattern *credit|*ssn would not be valid.
Note — To minimize on false positives using the *SSN smart identifier, it may be helpful to use the *ssn smart identifier along with other filter criteria. One example filter that can be used is the “only-body-contains” filter condition. This will only evaluate the expression to be true if the search string is present in all of the message body mime parts.
For example, you
could create the following filter:
SSN-nohtml: if only-body-contains(“*ssn”) { duplicatequarantine(“
Policy”);}