Marking Detectors: CUI, Classification Banners and TLP

Part of Security rules.

Protective marking or your own terms recognizes text that looks like a protective marking or banner, such as CUI, NOFORN, or TLP:RED, and the terms your organization supplies. Recognizing a marking is not a determination of what a document is. A document with no marking can still be controlled or classified, a marking can be wrong or out of date, and a marker quoted in a harmless discussion will also match. Do not use these detectors to decide that content may be handled in a given environment. Whether a deployment may process controlled or classified information is an authorization and accreditation question outside this feature. The detector is available only when your deployment administrator has opened the detector library.

The built-in families cannot be published until your deployment records a review. The grammars and the wording on this page have not yet had a review by someone with marking-program knowledge, and a rule that uses a built-in family is refused at publish with an explanation until your deployment's operator records that review. You can still create, edit, and test such a rule. A rule that uses only your own terms can be published without it. Ask your operator whether the review has been recorded.

Built-in families (each is a checkbox; the editor lists what each recognizes and where):

Family	Recognizes	Position rules and limits
Controlled unclassified information (CUI)	CUI or CONTROLLED followed by // and a category or dissemination marking; (CUI) and (CUI//category) at the start of a line; CUI, (CUI) or [CUI] as the first word of a line or after Subject:, Re: or Fw: when a dash or colon follows; the CUI Category: label	Categories are matched by shape or from a list of known ones, not from a fixed category list. A bare CUI is a banner as a whole line or at the front of a subject or line as above; the acronym in the middle of a sentence is not matched, and a line such as "CUI: what it is" in training material will match. Controlled by: and dissemination labels count only with another CUI marking or a second label.
Classification banners, portion marks, and dissemination controls	A level followed by // and controls (TOP SECRET//SI//NOFORN); a line that is only TOP SECRET or SECRET; portion marks such as (S), (TS//SI) and (S//NF) at the start of a line; NOFORN, ORCON, RELIDO, FOUO, FOR OFFICIAL USE ONLY, and REL TO followed by country codes	The words secret and confidential are never matched in prose. A banner or portion mark with controls matches in any case (Secret//NoForn); after the // a word this release does not know must be capitalized, so a footer such as "Confidential // Internal" is not a banner. (C) is also a list item and a copyright mark, so it counts only with another classification marking, a line that is only CONFIDENTIAL, or three or more (C) marks, and never when followed by a year or "copyright". A line that is only CONFIDENTIAL or UNCLASSIFIED is not a finding by itself (UNCLASSIFIED means uncontrolled, and a bare CONFIDENTIAL banner is too common in ordinary business documents), and a bare (U) is not matched for the same reason; (U//FOUO) and UNCLASSIFIED//FOUO are.
Export-control notices	ITAR, EAR99, "subject to the EAR", "export controlled", "ITAR-controlled", "EAR-controlled", "Arms Export Control Act", "USML Category" and a number, the notice "technical data whose export is restricted", and Export Control Classification Numbers	An ECCN has the shape of many part numbers, so it matches only with export wording such as ECCN, export, Commerce Control List, CCL, EAR, License Exception or NLR within about 60 characters. The bare word EAR matches only after phrases such as "subject to the".
Distribution statements	"Distribution Statement" or "Dist. Statement" followed by a capital B to F (punctuation between is ignored), "Distribution authorized to", "Further dissemination only as directed by"	Statement A marks material approved for public release, which is uncontrolled, so it is not matched.
Traffic Light Protocol	TLP:CLEAR, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, TLP:RED, and the legacy TLP:WHITE	Any case, with a colon, hyphen or space. TLP is a convention between people, not a technical control.
Proprietary and privileged banners	A whole line such as COMPANY CONFIDENTIAL, PROPRIETARY, INTERNAL USE ONLY, DO NOT FORWARD, DO NOT DISTRIBUTE, ATTORNEY-CLIENT PRIVILEGED, TRADE SECRET	Generic: only the common banners, and only as the whole line. A line that is only RESTRICTED is not matched, because it is also a NATO and UK classification level. Use your own terms for your organization's markings. Not selected by default.

A whole line form accepts decoration around the marking (asterisks, brackets, quotes, dashes) but not other text on the same line. A portion form is parenthesized at the start of a line. Forms with // and the unambiguous controls match anywhere in a line.

Your own terms are literal text, one per line: up to 200 terms of up to 100 characters, for internal markings, program names, or handling caveats. A term is matched exactly as typed, as a whole word, and never as a pattern: ACME (RESTRICTED) or C++ match those characters and nothing else, and no term can slow the check. Use Where your terms must appear to require the term as a whole line (Banner; a line that starts with the term and has no lowercase letters after it also counts), parenthesized at the start of a line (Portion), or anywhere as a whole word. Case is ignored unless you ask for it. The editor lints the list as you type: a blank, one-character, or duplicate term (duplicates are decided after case, spacing, and Unicode form are ignored) and a list of more than 200 terms are errors the server rejects at save, and an ordinary word such as "Draft" or "Internal", or a term under four characters, is a warning, because it will match everywhere it appears. A rule that uses only your own terms must contain at least one term.

Options also include Minimum matches and Count distinct markings (a rule that waits for two different markings). Markings are read through the normalized text and a fold of look-alike Cyrillic and Greek letters, so spacing around //, zero-width characters, fullwidth letters, look-alike letters, HTML entities, and mixed-case banners and controls are found, and for HTTP content the percent-encoded, base64, and nested JSON views are read too. Not claimed: leetspeak, letters separated by spaces or dots, reversed text, a marking split across lines, a lowercase CUI or SECRET alone on a line, lowercase country codes after REL TO on their own, a whole-line marking that shares its line with other text, look-alike letters outside the fold, and text in images or unsupported attachments.

Block is available on every target. The editor warns that a marking quoted in a discussion, a stale footer, or a template will also match and stop the action, and that on incoming content anyone who can send content to the agent can trigger it.

Findings and rule evaluations record only the detector, its version, and counts per kind of marking (for example {"tlp": 1}). They never contain the marking or your terms. Test detector adds the same counts and why candidates were rejected (an ambiguous mark with no corroboration, an ECCN without export wording, a term outside the position you chose). If your Organization turns on Capture full evidence, the content of a matching action is stored encrypted for the evidence retention period, and it contains the marking.

Back to Security rules.