How to Create a Custom Classification

Overview: What is a Custom Classification?

Classification is the first step in remediating sensitive data in your environment.

Spirion enables users to create classifications unique to an organization’s environment which align with the organization’s privacy plan.

Before Getting Started

• Classifications are set in the console, but the database file classification.db is sent to the Agents to distribute classification
• If an organization desires to use an icon, recall the icon must be 8-bit

User Access

• USER ACCESS: To view and manage Classifications your user account must be a member of a role with the permission Manage Administrative Settings.
• Example: By default, the Admin role has this permission.
  
  

How to Create a Classification

To create a new Classification, use the following steps:

1. From the left side navigation menu vavigate to Settings > Global Classifications.
   
   
2. The "Classifications" page opens.
3. In the top right corner click the Actions button.
4. Click Add New from the drop-down menu.
5. The Add Classification pop-up window opens. Fill in the following: 
6. 1. Name: This is the name of the new classification.
   2. 1. Examples: ReferenceOnly, Oct25-Test-1, SSN_RegEx, 1-Priority, Critical, EU-Standard-Reg, etc.
      2. Note: Secret, Top Secret, and Classified are native, built-in classification types. You cannot create new classifications with these names. You can edit these native classification types.
   2. Type: This is the type of classification that you are creating.
   3. • Type SENS requires an icon or color.
      • Note: You can also create a custom type by clicking the blue link “Create Custom Type”
   3. Description: This describes the classification. Spirion recommends you enter the questions "What is being classified" and "Why it is being classified" here.
      
      
6. Assign a color or icon to the classification:
7. • Color is optional, but recommended.
   • Icon is optional, but recommended. If no icon is provided, the default icon - which is a '+' sign - is used.
     Note: An icon file (.ico) can only be used for one Classification at a time.
     Note: Type Sensitivity (SENS) requires an icon or color.
   • When you assign a color a pop-up dialog appears.
   • A custom color can be selected, or you can choose from preselected swatches.
     
     
7. Click the OK button.
8. Use Classification Prefix - When this checkbox is selected, the Agent adds the prefix to the file during classification.
9. Click the Confirm button.

How Classifications are Applied to Files

Classifications are applied to files one of two ways:

• Database-Only Classification (Logical / Non-Persistent):
• • The classification is recorded only within the Spirion Database/Console Catalog. The physical file on the storage endpoint is not modified.
  • When a scan discovers sensitive data matching a policy, the agent reports the finding up to the console. The database links the file’s path, hash, and metadata with the assigned classification GUID/taxonomy.
  • When to use it:
  • • Read-only shares, immutable archives, or Targets where the scanner does not have write/modify permissions.
    • Environments where changing file hashes, modification timestamps, or metadata is prohibited by compliance or forensic policies.
    • Cloud/SaaS Targets where in-place metadata rewriting is disabled or unsupported.
• Persistent Classification (Database + File Metadata / Tagging):
• • The classification is recorded in the Spirion Database AND written directly into the file's metadata/system attributes.
  • The Agent modifies the target file to embed Spirion classification tags (including the Classification Name and unique GUID). Downstream tools (such as DLP, CASB, firewalls, and EDR agents) can read these tags independently.
  • Where the metadata is stored by file type:
  • • Microsoft Office (.docx, .xlsx, .pptx): Stored inside the custom document properties XML (docProps/custom.xml).
    • PDF Documents (.pdf): Stored in the PDF Document Information dictionary and XMP metadata stream.
    • Images (.jpg, .png, .tif): Stored in standard XMP/EXIF metadata fields.
    • Generic Windows Files / NTFS: Stored in an NTFS Alternate Data Stream (ADS) attached to the file without altering the primary data stream.

What do I do if Classifications are not Applied?

When a classification does not apply properly, there are several troubleshooting steps you can take either before contacting support or with the assistance of support.

If Classification is being Applied Only to the Spirion Database

If you want your classification to apply to the file which contains the sensitive data but it is being applied only to the Spirion database, take the following steps

Procedure:

1. Make sure that the scan you are running has the correct playbook associated with the scan.
2. If you changed the playbook before starting the scan edit the scan to make sure that the playbook is still selected.
3. Double check the logic in your playbook.
4. 1. For example, if you have a document that has a social security number that should be classified as confidential does the playbook logic look for a social security number?
   2. Does that logic level then have a classification action associated with it?

If Classification is being Applied to Both the File and the Database

Procedure:

1. Check to make sure that the service account the location being authenticated with has the ability to write to the location being searched.
2. Is the classification.
3. • For example, if a file share is being searched then the service account used to authenticate the file share for searching must have write access to that location to write the classification to the metadata.
3. Is the classification database on the agent malformed?
4. • Navigate to the directory: C:\ProgramData\Identity Finder\Application\Console\Classifications
   • This directory contains the classification database on the agent.
   • • Does it have a size?
     • Does it exist?
     • If the answer is no to either of these questions, contact support.

MPIP Classification Exception

Classifications do not show in Windows Explorer if a file has been MPIP-protected.