Using PowerSehll to create DLP Policy Rules

[Paul Stork]

Can anyone point me to more in depth information than what is presented in the New-DLPComplainceRule documentation on TechNet?  I'm trying to create some complex policies using PowerShell.  I've got it working for a simple Policy with multiple rules using an "OR" operator.  But if you switch the rules to use an "And" operator or create Groups of Rules with either an "and" or an "or" operator I can't seem to get the syntax of the -ContentContainsSensitiveInformation parameter right.  To do multiple rules you need to do an array of hashlists.  That works.  To do multiple rules with an "And" that property will end up with an array of hashlists where the hashlist is itself an array of hashlists.  Add in Groups and you get three levels.  But when I do that nesting I get an error saying "Property 'sensitivetypes, labels' value is not expected to be null."  The sensitivetypes property is one of the lower level hashlists.  But I don't see a labels value that can be set.  Anyone have documentation or a working example of a New-DLPCompliancePolicyRule?

[#2]

I was able to find the solution for my issue. Essentially there are two formats, a simple one and a complex one with groups and operators. The simple looks like this from a high level (and is documented in TechNet for the PowerShell command). It is an array of hashlist values and looks like this: -ContentContainsSensitiveInformation @(@{Name={GUID}; Mincount="1"; Maxcount="9"; Minconfidence="75"; Maxconfidence="100"},@{another hashlist of values}) This only covers the case where there are one or more Sensitive information types connected by an "OR" operator (which is the default). The more complex format that contains one or more groups of Sensitive Information types is three layers of Arrays of hashlists. It looks like this: -ContentContainsSensitiveInformation @(@{operator="And"; groups= @(@{operator="Or"; name="GroupName"; sensitivetypes= @(@{Same Hashlist contents as Sample1},@{Same Hashlist contents as Sample1})}, @{operator="Or"; name="Group Name"; sensitivetypes= @(@{Same Hashlist contents as Sample1},@{Same Hashlist contents as Sample1})})}) You must use this format even if you only want one group with two SIs connected by the operator "And". I haven't found any documentation on this at all, but it does work.