Custom scanners

This is where the magic starts.

There are three different types of scanners:

  1. Keyword scanner - you can define specific keywords which will trigger the scanner. It can not only block but also redact.
  2. Regex scanner - you can define specific regex filters which will trigger the scanner. It can not only block but also redact.
  3. GenAI scanner - this is the real magic: define in natural language what you want to be identified and blocked. We will go in-depth in the next section.

Keyword scanner

Use exact-word guardrails when:

  • The word is intentional
  • The word is rare
  • The word has binary meaning (present = act, absent = ignore)

For example, we have internal projects called Phoenix and Scooby Doo, and we want to make sure that if either is referenced, that message will get blocked.

  1. In the main left tab go to Scanners ⇒ Build a custom scanner ⇒ Keyword scanner
  2. Set the Name to Internal Projects
  3. In the Keywords enter Phoenix and Scooby Doo
  4. Click Save ⇒ Save version

After saving the scanner we find ourselves in the Playground area. Here we can directly test all custom scanners against different text patterns.

  1. Enable Test for the Internal Projects scanner on the right-hand side of the page.

  2. In the message input area of the Playground enter the below text.

    Project Phoenix has the potential of taking over the world. This information should be kept private by all means and at any cost.

  3. The previous message was blocked. Enter anything that is not Phoenix or Scooby Doo and the message will pass.

Regex scanner

Use regex guardrails when:

  • The value changes, but the format doesn’t
  • There are multiple acceptable spellings or layouts
  • You need precision and explainability
  • You want to block or allow a specific structure
  • You’re defending against known attack templates

For example, we want to ensure that the response does not contain any internal private IPs from our company.

  1. In the main left tab go to Scanners ⇒ Build a custom scanner ⇒ Regex scanner
  2. Set the Name to Internal IPs
  3. In the Regular expression enter: (?i)\bhttps?:\/\/(localhost|127\.0\.0\.1|0\.0\.0\.0|10\.(?:\d\d?\d?\.)\d\d?\d?|172\.(?:1[6-9]|2\d|3[0-1])\.(?:\d\d?\d?\.)\d\d?\d?|192\.168\.(?:\d\d?\d?\.)\d\d?\d?)(?::\d+)?(?:\/[^\s]*)?
  4. Click Save ⇒ Save version

After saving the scanner we find ourselves in the Playground area. Here we can directly test all custom scanners against different text patterns.

  1. Enable Test for the Internal IPs scanner on the right-hand side of the page.

  2. In the message input area of the Playground enter the below text.

    To access the admin site, use https://192.168.0.1/admin.

  3. The previous message was blocked. Change the IP to something public like 112.44.223.44 and the message will not be blocked.