In the Security Cloud Control platform menu, choose Products > Multicloud Defense .

Navigate to Policies > Profiles > Data Loss Prevention.

Click Create Intrusion Profile.

Select Data Loss Prevention.

Provide a unique Name and enter a description for the profile.

Enter the DLP Filter List in the table.

Click Add to insert more rows as needed.

Provide a Description for the filter.

Choose a predefined static pattern (e.g CVE Number) from the dropdown list or provide a custom Regular expression.

Provide a count to define the number of times the pattern must be seen in the traffic.

Select an Action to take if the pattern matches the count number of times.

There are cases where the pre-defined pattern for AWS Access Key and AWS Secret Key doesn’t match in DLP inspection due to pattern being more restrictive. Use the following relaxed custom pattern in DLP profile to detect AWS Access Key and AWS Secret Key. Be aware that this could generate false positives log events. AWS Access Key: (?<![A-Z0-9])[A-Z0-9]{20}(?![A-Z0-9]) AWS Secret Key: (?<![AZa-z0-9/+=])[A-Za-z0-9/+=]{40}(?![A-Za-z0-9/+=])