Data Loss Prevention — Rules Reference ENT

Defining content-scanning rules that block sensitive data from being archived, and reading the DLP audit log.

Audience: IT / security administrators · Applies to: Slim Archiver Enterprise.

What DLP does

When DLP is enabled, Slim Archiver scans the text content of files before they are compressed. If a file matches a rule marked to block, the archive operation is refused and the match is recorded in the audit log. DLP is configured entirely through your machine policy file.

1. Where DLP is configured

DLP rules live in the machine policy file, under a dlp section:

C:\ProgramData\Slim Archiver\policy.json

DLP is active only when the section is present, enabled is true, and at least one rule is defined. Save the file as UTF-8; a leading byte-order mark (BOM) is tolerated.

2. Policy structure

The dlp section has an enabled flag and a rules array. Each rule has three fields:

2.1 Example policy.json

{
  "dlp": {
    "enabled": true,
    "rules": [
      { "name": "US SSN", "pattern": "\\b\\d{3}-\\d{2}-\\d{4}\\b", "action": "block" },
      { "name": "Credit card", "pattern": "(?i)\\b(?:\\d[ -]*?){13,16}\\b", "action": "block" }
    ]
  }
}

3. Writing patterns

• Patterns are standard regular expressions, matched against the extracted text of each file.
• Case-insensitive matching: prefix the pattern with (?i). Slim Archiver recognizes this prefix and applies case-insensitivity — e.g. (?i)confidential.
• Matching is global — a rule triggers on the first match found in a file.

4. Actions & what happens on a match

When a rule matches a file, the match is always written to the audit log. What happens next depends on the rule's action:

5. Fail-closed behavior

So that DLP cannot be silently bypassed, Slim Archiver treats anything it cannot fully evaluate as a block when DLP is enabled:

• A file too large to scan (over the read limit) is blocked rather than passed unscanned.
• A file whose extracted text exceeds the per-pattern scan limit is blocked.
• A rule whose regular expression is invalid (won't compile) causes the file to be blocked — the scan could not be evaluated, so it fails closed.

6. The DLP audit log

Matches are recorded to:

C:\ProgramData\Slim Archiver\Logs\dlp_audit.log

Each entry is a single line:

[2026-01-15T09:30:00.000Z] USER=jdoe FILE="C:\path\file.txt" RULE="US SSN" ACTION=block MATCH="12********89 (len=11)"

The matched value is masked — only the first and last two characters and the length are kept, so the log helps you triage without storing the sensitive data it detected. Note that the log directory is under ProgramData; protect it with appropriate file-system permissions, and consider forwarding events to your central audit system (Windows Event Log / SIEM), which the app also supports.

7. Testing a rule (recommended before deployment)

• On a test machine, enable DLP with your new rule in policy.json.
• Create a throwaway file whose content matches the pattern; attempt to compress it.
• Confirm the operation is blocked and an entry appears in dlp_audit.log naming your rule.
• Create a file that should NOT match; confirm it compresses normally.
• Because a bad pattern fails closed, verify the rule compiles by confirming normal (non-matching) files still compress after the rule is added.

8. Troubleshooting