Custom DLP Patterns

const result = await client.dlp.patterns.dryRun({
  expression: '\\bPROJ-[0-9]{4,6}\\b',
  action: 'alert',
  sampleSize: 50,
});

// result.matches — array of masked excerpts
// result.matchCount — total hits across sampled payloads
console.log(`Matched ${result.matchCount} times across ${result.sampleSize} payloads`);

{
  "event": "dlp.notify",
  "version": 1,
  "patternId": "550e8400-e29b-41d4-a716-446655440000",
  "patternName": "internal-project-codes",
  "action": "notify",
  "actionTaken": "notify",
  "tenantId": "550e8400-e29b-41d4-a716-446655440001",
  "agentId": "550e8400-e29b-41d4-a716-446655440002",
  "mcpServerId": "550e8400-e29b-41d4-a716-446655440003",
  "interactionId": "550e8400-e29b-41d4-a716-446655440004",
  "contentHashSha256": "a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3",
  "contentHash": "a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3",
  "severity": "high",
  "gdprClassification": "credential",
  "timestamp": "2026-05-30T14:22:00.000Z"
}

import crypto from 'node:crypto';

export function verifySignature(rawBody: string, secret: string, header: string): boolean {
  if (!header.startsWith('sha256=')) return false;
  const expected =
    'sha256=' +
    crypto.createHmac('sha256', secret).update(rawBody, 'utf8').digest('hex');
  const a = Buffer.from(expected, 'utf8');
  const b = Buffer.from(header, 'utf8');
  if (a.length !== b.length) return false;
  return crypto.timingSafeEqual(a, b);
}

// Express: capture the raw body before JSON parsing
// app.use('/shieldagent-notify', express.raw({ type: 'application/json' }));
// app.post('/shieldagent-notify', (req, res) => {
//   if (!verifySignature(req.body.toString('utf8'), process.env.SHIELDAGENT_WEBHOOK_SECRET!, req.header('x-shieldagent-signature')!)) {
//     return res.status(401).end();
//   }
//   const payload = JSON.parse(req.body.toString('utf8'));
//   res.status(200).json({ ok: true });
// });

import hmac, hashlib

def verify_signature(raw_body: bytes, secret: str, header: str | None) -> bool:
    if not header or not header.startswith('sha256='):
        return False
    expected = 'sha256=' + hmac.new(
        secret.encode('utf-8'), raw_body, hashlib.sha256
    ).hexdigest()
    return hmac.compare_digest(expected, header)

# FastAPI example:
# @app.post('/shieldagent-notify')
# async def handle(request: Request):
#     raw = await request.body()
#     if not verify_signature(raw, os.environ['SHIELDAGENT_WEBHOOK_SECRET'],
#                             request.headers.get('x-shieldagent-signature')):
#         raise HTTPException(401)
#     payload = json.loads(raw)

secret = "shieldagent-test-secret-32ch-pad"
body   = '{"event":"dlp.notify","version":1,"hash":"deadbeef"}'
header = "sha256=8834a0520425c5b374ab3d444d3c0368cb6eb1af1a1678a2ed5e8937e8bcb06f"

{
  "text": ":warning: ShieldAgent DLP notify: `internal-project-codes` (high)",
  "blocks": [
    {
      "type": "section",
      "text": {
        "type": "mrkdwn",
        "text": ":warning: ShieldAgent DLP notify: `internal-project-codes` (high)"
      }
    },
    {
      "type": "section",
      "fields": [
        { "type": "mrkdwn", "text": "*Pattern*\ninternal-project-codes" },
        { "type": "mrkdwn", "text": "*GDPR class*\ncredential" },
        { "type": "mrkdwn", "text": "*Agent*\n`550e8400-e29b-41d4-a716-446655440002`" },
        { "type": "mrkdwn", "text": "*MCP server*\n`550e8400-e29b-41d4-a716-446655440003`" },
        { "type": "mrkdwn", "text": "*Interaction*\n`550e8400-e29b-41d4-a716-446655440004`" },
        { "type": "mrkdwn", "text": "*Content SHA-256*\n`a665a45920422f9d…`" }
      ]
    },
    {
      "type": "context",
      "elements": [
        { "type": "mrkdwn", "text": "event=dlp.notify version=1 ts=2026-05-30T14:22:00.000Z" }
      ]
    }
  ],
  "metadata": {
    "event_type": "dlp.notify",
    "event_payload": { "...": "full canonical payload — same fields as webhook schema above" }
  }
}