Example of Sensitive Data Definition (SDD) Logic

Sensitive Data Definitions (SDDs) use logical and proximity operators to combine multiple Data Types into a single, high-signal rule.

Here are example Sensitive Data Definition logic patterns using the standard Spirion operators:

1. Proximity Logic (Reducing False Positives)

This is the most common use case for PHI or PCI data, where you want to ensure an identifier is actually linked to a sensitive context.

Logic: [AnyFind: Social Security Number] NEAR WITH DISTANCE (50) [Custom Dictionary: Medical_Terms]
Operator: Near with Distance
Result: Only flags the file if a validated SSN is found within 50 characters of a word like "Diagnosis," "Patient," or "Treatment."

2. Required Combination (High-Risk Situations)

Use this when a single data type isn't enough to justify a "Restricted" label, but two together are.

Logic: [AnyFind: Credit Card Number] REQUIRE [AnyFind: Social Security Number]
Operator: Require
Result: The file is only flagged if both a Credit Card and an SSN are present anywhere in the document.

3. Positional Logic (Form/Structured Data)

Use this for structured documents like applications or medical forms where the identifier always follows a specific label.

Logic: [Keyword: "Patient ID:"] NEAR AFTER WITH DISTANCE (20) [Custom Regex: MRN_Pattern]
Operator: Near After with Distance
Result: Only flags if the MRN pattern appears within 20 characters after the specific string "Patient ID:".

4. Exclusionary Logic (Suppressing Known Noise)

Use this to ignore "Sample" data or templates that frequently trigger false alerts.

Logic: [AnyFind: Health Information] DOES NOT EQUAL [Keyword: "Sample Patient"]
Operator: Does Not Equal (or using Far logic)
Result: Flags health information unless the specific phrase "Sample Patient" is also present in the file.

5. Value-Based Logic (Financial/Thresholds)

Use this for prioritizing remediation based on the "amount" of sensitive data or specific numerical values.

Logic: [AnyFind: Credit Card Number] GREATER THAN (10)
Operator: Greater Than
Result: Only triggers if the file contains more than 10 unique credit card numbers, helping you focus on bulk data leaks rather than individual receipts.

Summary of Available SDD Operators

Operator	Description
Near / Far	Finds data within (or outside) a general proximity.
Near with Distance	Finds data within a specific character count (e.g., 50 chars).
Before / After	Enforces a specific sequence (e.g., "Label" must come before "Value").
Require / Allow	Enforces mandatory combinations or optional additions.
Equals / Not Equals	Matches (or excludes) exact values or strings.
Greater / Less Than	Filters based on numerical thresholds or counts.

Operational Tip: When building SDD logic, always start with a "Near with Distance" of 50–100 characters. This is generally the "sweet spot" for identifying data that is visually and logically linked on a page or in a spreadsheet row.