# How to Customize Risk Levels for Outbound File Transfer Activity in Leak Tracking Canonical: https://www.nsecsoft.com/en/course/custom-risk-level.html Language: en-US Updated: 2026-11-04T07:59:44.682777Z Different companies often have completely different standards for judging what behavior is considered a high\-risk leak\. For some companies, sending office documents through corporate WeChat is an acceptable behavior; for other companies, as long as files are uploaded through personal chat tools, network disks or browsers, it should be considered a high\-risk event\. Ping32 provides \[…\] Different companies often have completely different standards for judging what behavior is considered a high-risk leak. For some companies, sending office documents through corporate WeChat is an acceptable behavior; for other companies, as long as files are uploaded through personal chat tools, network disks or browsers, it should be considered a high-risk event. Ping32 provides a configurable **risk rating** mechanism precisely to allow administrators to conduct more realistic risk stratification for leaks based on their own business and compliance requirements. #### **Purpose and significance** In order to adapt to the differences in software usage scenarios and compliance requirements of different enterprises, Ping32 supports setting different risk levels for different leak channels in a "configurable" way. Enterprises can define more realistic risk rating rules for different leakage channels based on their own business characteristics and security strategies. By customizing the risk level for leakage, enterprises can achieve: - **Avoid false positives and reduce excessive alerts**: Define risk conditions by yourself, reduce invalid alerts, and allow security teams to focus on real high-risk events. - **Improve audit efficiency**: Risk levels are clearer and more realistic. Auditors can quickly locate suspicious events by filtering specified levels. - **Meet differentiated needs**: Different enterprises have different business models and compliance requirements, and the leakage standards in various scenarios can be flexibly configured; risk identification is more intuitive and explainable. #### **Setting process** The following uses a typical scenario example to illustrate the configuration idea: > Company A is an industrial design enterprise and uses **Enterprise WeChat** for office work. > > - Sending files through corporate WeChat: lower risk > - Sending specific types of files (such as `dwg`, `x_t`, `prt`, etc.) through personal WeChat, QQ, etc.: higher risk > > Target: > > - All documents sent out via Enterprise WeChat: Risk level = **Normal** > - WeChat/QQ outbound specified file type: Risk level = **High risk** **Enter the risk rating setting page** Select **Data Security** → **Leakage Tracking** → **Risk Rating** to enter the leakage risk rating setting page. ![]() **Add risk rating rules for Enterprise WeChat (normal)** 1\. Click **Add** on the risk rating page to add a new leak risk definition rule. 2\. In the rule definition interface, select **Leakage Channel** from the drop-down menu as **Specify the leakage channel** . 3\. Click the **Gear** button at the rear to enter the "Specify Leakage Channel" settings. 4\. In the pop-up interface, enter the **Software** option, check **Enterprise WeChat** in the **Social** category, and click **OK** . 5\. Return to the rule definition interface and select **Risk Rating** under this approach as **Normal** (the default level is Normal).Click **OK** to complete the setting of "All files sent out by Enterprise WeChat = Normal". **Add risk rating rules for WeChat and QQ (high risk, specified file type)** 1\. Click **Add** again to add a new rule. 2\. Set **Leakage Channel** to **Specify Leakage Channel** and select **WeChat** or **QQ** through the gear. 3\. Set **File Type** to **Specified File Type** and click **Gear** to enter the file type setting interface. 4\. In the file type setting interface: - You can click **Select File Type** in the upper right corner to quickly select the file type of a specific program; - You can also click **Add** in the upper left corner to manually enter the file type (for example: `dwg`, `x_t`, `prt`, `docx`, etc.). - Click **OK** after configuration is completed. 5\. Return to the rule definition interface and set the **Risk Rating** to **High Risk** . ![]() 6\. Click **OK** → **OK** to complete the rule configuration. **Further refine conditions (optional)** The risk rating system also supports additional combinations of conditions for more precise risk definition, such as: - **Specify file size** - **Determine whether the file contains sensitive content** It can be used in combination according to actual needs to achieve a more fine-grained risk rating strategy. #### **Realize the effect** After the configuration is completed, the following effects can be achieved: - Outgoing `txt` files via QQ: Risk rating is **Normal** - Sending specified types of files such as `x_t` and `docx` through QQ: the risk rating is **High Risk** - Outbound files of any type via Enterprise WeChat: the risk rating is always **Normal** At the same time, you can quickly locate all **high-risk** leak events by **screening risk levels** in the leak tracking records to improve audit and response efficiency. #### **Implementation Suggestions** - Risk rating rules are recommended to be formulated based on the company's real business scenarios to avoid simply copying general standards. - If there are different file types, different file sizes, or different levels of sensitive content under the same leakage channel, it is recommended to use more refined combination conditions instead of just roughly dividing by software name. - After the rules are launched, it is recommended to regularly review the distribution of events at each level in **Leak Tracking** to determine whether the risk stratification is too wide or too narrow, and continue to optimize according to the actual situation.