Data Loss Prevention — Rules Reference ENT

Defining content-scanning rules that block sensitive data from being archived, and reading the DLP audit log.

Audience: IT / security administrators · Applies to: Slim Archiver Enterprise.

What DLP does

When DLP is enabled, Slim Archiver reads the content of every file before it is compressed and matches it against your rules. What a file is decided from its content (its first bytes), not from its name or extension, so renaming a file does not change how it is scanned. If a file matches a rule marked to block, or cannot be inspected (section 5), the archive operation is refused. DLP is configured entirely through your machine policy file.

1. Where DLP is configured

DLP rules live in the machine policy file, under a dlp section:

C:\ProgramData\Slim Archiver\policy.json

DLP is active only when the section is present, enabled is true, and at least one rule is defined. Save the file as UTF-8; a leading byte-order mark (BOM) is tolerated.

2. Policy structure

The dlp section has an enabled flag and a rules array. Each rule has three fields:

The dlp section can also set blockUnscannedArchives (default false). When it is true, an archive that DLP cannot open (7z, RAR, gzip, xz, bzip2, zstd, CAB or .slim, also inside a ZIP) blocks compression instead of passing unscanned (section 3.1).

2.1 Example policy.json

{
  "dlp": {
    "enabled": true,
    "blockUnscannedArchives": true,
    "rules": [
      { "name": "US SSN", "pattern": "\\b\\d{3}-\\d{2}-\\d{4}\\b", "action": "block" },
      { "name": "Confidential marking", "pattern": "(?i)\\bstrictly confidential\\b", "action": "block" },
      { "name": "Project codename (monitor)", "pattern": "(?i)\\bproject aurora\\b", "action": "log" }
    ]
  }
}

The first two rules block; the third only records a match in the audit log (any action other than block).

3. Writing patterns

• Patterns are JavaScript regular expressions, matched against the text DLP reads from each file (section 3.1).
• Case-insensitive matching: include (?i), normally at the start of the pattern; the whole pattern is then matched case-insensitively, e.g. (?i)confidential.
• A rule triggers on the first match in a file; each matching rule is logged once per file, and a rule whose action is block stops the scan of that file.

3.1 What DLP reads

4. Actions & what happens on a match

When a rule matches a file, the match is always written to the audit log. What happens next depends on the rule's action:

5. Fail-closed behavior

So that DLP cannot be silently bypassed, Slim Archiver blocks a file it cannot inspect when DLP is enabled:

• An Office, OpenDocument, ZIP or PDF file over 100 MB, or a ZIP entry over 100 MB (these are read whole). Text files have no size limit (section 3.1).
• An encrypted or unreadable Office document, an encrypted ZIP entry, an unreadable ZIP, or a file that cannot be opened.
• A rule whose regular expression is invalid (it won't compile): the first file it is applied to is blocked.
• With blockUnscannedArchives set to true: an archive DLP cannot open.

In these cases the user sees the error card “Data Loss Prevention: File Not Inspected” (not a rule match), and the message names the file and the reason, e.g. File "big.pdf" was not inspected by DLP: File could not be scanned by DLP (oversize); blocked by fail-closed policy. Compression blocked. These blocks are recorded too (section 6).

6. The DLP audit log

Matches are recorded to:

C:\ProgramData\Slim Archiver\Logs\dlp_audit.log

Each entry is a single line:

[2026-01-15T09:30:00.000Z] USER=jdoe FILE="C:\path\file.txt" RULE="US SSN" ACTION=block MATCH="12********89 (len=11)"

The matched value is masked — only the first and last two characters and the length are kept, so the log helps you triage without storing the sensitive data it detected. A file blocked because it could not be inspected (section 5) is recorded with RULE="(unscannable)", "(unscanned archive)" or the invalid rule's name, and REASON="..." (the explanation the user sees) instead of MATCH, e.g.:

[2026-01-15T09:31:00.000Z] USER=jdoe FILE="C:\path\data.7z" RULE="(unscanned archive)" ACTION=block REASON="An archive DLP cannot open (7z, RAR, gzip, ...) is blocked by policy (dlp.blockUnscannedArchives)."

Every entry also goes to the application's audit trail: C:\ProgramData\Slim Archiver\Logs\audit.log (Enterprise license), the Windows Event Log when the policy sets writeToEventLog, and a syslog / SIEM endpoint when it sets syslogEndpoint. If dlp_audit.log cannot be written, the event is sent to the Windows Event Log in any case and the user's block message ends with a warning. The log directory is under ProgramData; protect it with appropriate file-system permissions.

7. Testing a rule (recommended before deployment)

• On a test machine, enable DLP with your new rule in policy.json.
• Create a throwaway file whose content matches the pattern; attempt to compress it.
• Confirm the operation is blocked and an entry appears in dlp_audit.log naming your rule.
• Create a file that should NOT match; confirm it compresses normally.
• Because a bad pattern fails closed, verify the rule compiles by confirming normal (non-matching) files still compress after the rule is added.

8. Troubleshooting