Policy Store File Format

The Policies page is backed by a plain-text policy store, policies.conf, on the appliance. The console writes it automatically; you can also edit it by hand, but restart the scoring service (System › Service Control › Lucien Scoring Service) to reload it.

Edit with care. A malformed line can prevent the engine from loading the store. Keep a backup before hand-editing.

Line format

Each non-comment line is a pipe-delimited record. The first field is the rule type; the remaining fields depend on the type. Blank lines and lines beginning with # are ignored.

Type	Fields	Example
FPGA	FPGA\|<policy name>\|<term,term,...>\|<SEVERITY>\|<ON/OFF>	FPGA\|sql injection\|union select,drop table,delete from\|CRITICAL\|ON
SUBSTR	SUBSTR\|<substring>\|<SEVERITY>\|<ON/OFF>	SUBSTR\|union select\|CRITICAL\|ON
KEYWORD	KEYWORD\|<word>\|<SEVERITY>\|<ON/OFF>	KEYWORD\|confidential\|HIGH\|ON
FUZZY	FUZZY\|<term>\|<max edit distance>\|<SEVERITY>\|<ON/OFF>	FUZZY\|ransomware\|2\|CRITICAL\|ON

Field notes

• Policy name (FPGA only): the display name you see in the Policies list. Spaces are allowed.
• Terms: comma-separated, matched case-insensitively. For FPGA rules the whole list is compiled to the accelerator as one policy. Multi-word phrases are fine.
• Severity: LOW, MEDIUM, HIGH or CRITICAL. Severity feeds the composite score and the max severity field of a verdict.
• Max edit distance (FUZZY only): how many character edits still count as a match; 2 catches most typos and light obfuscation.
• ON/OFF: whether the rule is enabled. OFF keeps the rule in the file without evaluating it, which is useful for terms that generate false positives (the shipped store has a couple of FUZZY rules parked OFF for exactly this reason).

How the types map to detection chips

File type	Chip in a verdict
FPGA	FPGA
SUBSTR	SUBSTR
KEYWORD	KW
FUZZY	FUZZY

The DEOBF and PII chips are produced by engine stages, not by file rules.

Policy categories in the shipped store

The default store groups rules under commented headings, for example: prompt-injection and jailbreak phrasing, SQL/shell/code injection, hacking tool names, weapons and violence, self-harm and crisis language, hate and harassment, drug slang, organised-crime terminology, HIPAA / PHI identifiers, data-exfiltration phrasing, parental-control topics, and Spanish-language equivalents of several of the above. Each category typically has one FPGA rule carrying the bulk of the terms plus a handful of SUBSTR, KEYWORD and FUZZY rules to catch spacing, suffix and spelling variants.

Example: a data-privacy policy

# Executive contact data: do not let these leave via prompts
FPGA|private executive information|s_stone@example.com,vandam@example.com|HIGH|ON
SUBSTR|@example.com|MEDIUM|ON

Add the policy through the console's Add Policy dialog (Type: Data Privacy) rather than editing the file, and the same lines are written for you.