Overview

 The DryvIQ Persistent Label Classifier allows you to apply labels to files that become part of the file and persist with the file through version changes or even migration. The solution has two parts:

1. The DryvIQ Persistent Label Classifier application: This desktop application is a separate service that runs outside of your DryvIQ Platform. It allows you to assign classification labels to all file types on your Windows NTFS. The labels will persist as long as the files stay on a Windows NTFS system. Copying or moving the files to a non-Windows system will cause label loss. The exception is for Microsoft Office XML file types (DOCX, XLSX, and PPT), for which labels will persist on non-NTFS platforms.  
2. DryvIQ Persistent Classifier Extension: This extension works within your DryvIQ Platform. It allows DryvIQ to label Microsoft Office XML file types (DOCX, XLSX, and PPT) and to identify files that have been labeled. For these file types, DryvIQ embeds the label in the XML file content. Since the Microsoft Office file standard reserves a location for such labels, DryvIQ can apply labels without risk of corruption. The labels will move with the file, regardless of platform. For example, if you zip a Microsoft Office XML file that contains a DryvIQ Persistent Label, the label will persist in the ZIP file. 
    

DryvIQ can detect the labels, and they are accessible to other tools. For example, you can perform an Intelligent Migration of all files with a particular label or use your existing Data Loss Prevention system (DLP) to restrict action on a file with a specific label.

Prerequisite

Before installing the DryvIQ Persistent Label Classifier, you must ensure the .NET 7.0 SDK is installed on the machine where you will be installing the application. If you do not have .NET 7.0 SDK installed, you will be prompted to download it when you attempt to use the DryvIQ Persistent Label Classifier Windows application. You can proceed with installing .NET 7.0 SDK once the download is complete.

Installing the Persistent Classifier Extension

The Persistent Classifier extension adds the Persistent Label Classifier entity type and Persistent Label action to your DryvIQ Platform instance, allowing you to use the Persistent Label Classifier in your content scans. You must ensure you have the latest extension. For new DryvIQ deployments, the extension can be added to your extensions.zip file with the other DryvIQ extensions that need to be installed. If needed, the extension can be added to an existing DryvIQ instance. Refer to the documentation page below that pertains to your installation scenario. Refer to Deploying Platform extensions to the DryvIQ Platform for more information. 

Creating the Classifier Log Table

By default, the DryvIQ Persistent Label Classifier uses an Azure Storage Account table to store logging for all label activity. You must create the table in your Azure storage account before installing the DryvIQ Persistent Label Classifier. Refer to Microsoft’s Create a Table in the Azure portal documentation for instructions on creating a table.

Generating the Log Table URL

Once you create the table, you must generate a URL by creating a Shared Access Signature (SAS). You will need this URL when installing the DryvIQ Persistent Label Classifier application. Use the information below to generate the SAS URL.

1. Go to the Azure Storage Account page where you created the logging table.
2. Click Security + networking.
3. Click Shared access signature.
4. Change the following settings:
   1. Allowed services: Table
   2. Allowed resource types: Object
   3. Allowed permissions: Add
   4. Start and Expiry times: Set to a sufficient expiration date; the URL will no longer work after this date.
   5. Leave all other settings at their default.
5. Click Generate SAS and connection string.
6. Copy the Table service SAS URL and modify it so the logging table name is between the host and the query parameters. For example, a table named mytable in a storage account named mystorageaccount should have a URL like https://mystorageaccount.table.core.windows.net/mytable?sv=2022-11-0...
7. Save the modified URL. You will need it during installation.

Understanding the Logging Table Columns

You will specify the SAS URL during the DryvIQ Persistent Label Classifier installation. During installation, DryvIQ will add seven columns to the table. The column names and brief descriptions of the information that will be stored in each column are listed below.  

• File path: The absolute file path for the classified file.
• Classification level: The label (color) added to the file.
• Classified on: The timestamp for when the file was classified.
• Classified by: The user who added the label to the file.
• Classified on device: The hostname for the computer used to classify the file.
• Downgrade reason: The explanation added for why the file label was downgraded. (See Editing Labels below.)
• Message: Explanation of the operation performed on the file (such as “file classified”).

Installing the DryvIQ Persistent Label Classifier Application

The DryvIQ Persistent Label Classifier is a separate service that runs outside your DryvIQ Platform. It allows you to manually assign classification labels to files on your Windows NTFS. DryvIQ logs all label activity in the Azure storage account table you created. You will specify the URL for the table during installation. You need to install the application using the instructions below.

Verifying the Installer Properties

In some instances, Windows will flag an executable as "untrusted" and block it. If this happens with the installer, there will be issues during installation. Therefore, before you begin, review the installer properties to verify the correct settings.

1. Right-click on the installer and click Properties.
2. Select Unblock.
3. Click Apply to apply the changes.
4. Click OK to close the modal.  

Installing the Application

1. Right-click on the installer and select Run as administrator (or Install if you don’t have the Run as administrator option).
2. Click Next on the Welcome to the DryvIQ Persistent Label Classifier Wizard page.
   
   
    
3. You must accept the end-user license agreement to continue. Use the link provided to review the license agreement. Then, select the I accept the terms in the License Agreement box and click Next.  
   
   
    
4. The Destination Folder page defaults to C:\Program Files\DryviqLabeler\ as the installation directory. Click Next to continue.
   
   
    
5. You are prompted to provide the log table URL. This is the URL for the Azure table you created in the “Generating the Log Table URL” section above. Add the URL and click Next. (If you don’t have the URL, you can continue without entering it, but you must configure the log table URL before using the Persistent Label Classifier. See “Configuring the Persistent Classifier Extension” below to add the log table URL after installation.)
   
   
    
6. Click Install on the Ready to Install DryvIQ Persistent Label Classifier page.
   
   
    
7. Click Yes if prompted to confirm you want the app to make changes to your device.
8. The installation begins.
9. When the installation is complete, you will see a Completed page. Click Finish to exit the installer.  
   
   

Configuring the Persistent Classifier Extension

If you did not add the URL for the classifier table when you installed the application, you will need to configure the Persistent Classifier Extension to add it before you can use the feature. The URL identifies where the table used to store the labels is located. You cannot use the DryvIQ Persistent Label Classifier without adding the URL.

1. Click Settings in the left navigation.
2. Verify you are on the Extensions page.
3. Click the ellipses on the persistent-classifier tile.
4. Click Configure.
   
   
    
5. Enter the URL for the Azure Storage Account table you created. See “Generating the Log Table URL” above for how to generate this URL.
   
   
    
6. Click Done to save the URL. 

Manually Applying Labels

The DryvIQ Persistent Label Classifier application can label files on your Windows NTFS. The labels will persist as long as the files stay on a Windows NTFS system. Copying or moving the files to a non-Windows system will cause label loss. The exception is for Microsoft Office XML file types (DOCX, XLSX, and PPT), for which labels will persist on non-NTFS platforms. The default label values are Red, Orange, Yellow, and Green. The DryvIQ Consultative Services Team may configure custom labels depending on requirements.

1. Right-click on the file or group of selected files you want to label.
2. Hover over Apply DryvIQ Label in the menu that displays.
3. Click the label you want to apply from the options that display.
   
   
    
4. Click OK to acknowledge the message that the label was successfully applied.  
   
   

Reviewing File Labels

1. Right-click on the file.
2. Hover over Apply DryvIQ Label.
3. Click Show Info from the options that display.
4. DryvIQ displays the file name and path, label level, date and time stamp for when the label was applied, and the username of the user who applied the label.
   
   
    
5. Click OK to close.

Editing Labels

1. Right-click on the file or group of selected files you want to label.
2. Hover on Apply DryvIQ Label.
3. Click the label you want to apply from the options that display.
4. If you are downgrading a label, you must add a memo for the change. This memo will be stored with the label information and can be pulled from the label table for reporting purposes as needed. Type the downgrade reason and click Proceed.  
5. Click OK to acknowledge the message that the label was successfully applied.  
   
   

Using Third-Party Reporting Tools

Because the DryvIQ Persistent Label Classifier stores logging data in an Azure Storage Account table, you can use any existing reporting tools you own to create reports on the labels. Point your reporting tools or a Data Loss Prevention system (DLP) to the logging table to generate any reports you need about your labeled content. Similarly, the DryvIQ label can be used by DLP products (for example, Microsoft Purview) to restrict actions on the file.