> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/system-management/settings/lexical-lists.md). # Lexical lists DoControl provides several out-of-the-box keyword lists for scanning. These lists are customizable, and can be included or excluded as conditions when defining workflows. For more information, see [comparators](/docontrol-user-guide/workflows/define-workflow-settings/trigger-settings.md#comparators). {% hint style="warning" %} You need **Admin** permission to create and edit lexical lists. {% endhint %} **Use case 1**: When scanning file names for sensitive information, DoControl checks if any keywords in the [Alert triggers](#edit-default-lexical-lists) list appear in the file name. If sensitive keywords are detected, DoControl generates an alert. **Use case 2**: Data shared with unauthorized, non-business contacts (private email addresses) could be an attempt to exfiltrate data. Moreover, personal email platforms as a rule do not require multi-factor authentication (MFA), which makes them the weak link in any chain of enterprise security solutions. As a remediation action, you can set up a workflow to prevent sharing data with private emails based on the list of private email domains. {% hint style="success" %} DoControl also leverages lexical lists to generate [alerts](#alerts-using-lexical-lists). {% endhint %}

DoControl provides out-of-the-box default lexical lists

{% hint style="info" %} Learn more about configuring keyword lists with [DoControl videos](/docontrol-user-guide/help/videos.md#lexical-analysis-in-docontrol). {% endhint %} ## Default lexical lists DoControl provides the following default lexical lists which can all be customized to meet your organization's requirements:

List name	Description	Keyword examples
Alert triggers	If the file name contains keywords in the Trigger alert list, the file is considered sensitive and an alert is triggered	agreement, classified, contract, employee, personnel, private, restricted, salary
Alert suppressors	If the file name contains keywords in the Suppress alert list, the file is considered less sensitive, and an alert is not triggered	announcement, newsletter, schedule, presentation, training
Encryption key files	A set of file extensions that indicate a file has been encrypted	.crt, .cst, .key
Ransomware encryption files	Common ransomware file extensions	.fun, .encrypted, .locked
Private email domains	A set of 200 private, non-corporate email domains. These domains can be used to trigger: A workflow if assets are downloaded or shared with private email domains. An alert if a company asset is shared with an actor having a private email domain.	gmail.com, yahoo.com, hotmail.com
Sensitive keywords	A set of words indicating PII (personally identifiable information) or company proprietary information. For example: A workflow is triggered if a sensitive keyword is detected in the asset name	confidential, legal, password, payroll, salary
Default file formats for data scanning	MIME file types that are supported for regex and PII scanning.	General: text/plain text/csv text/tab-separated-values application/pdf Google Drive: application/vnd.google-apps.document application/vnd.google-apps.presentation application/vnd.google-apps.spreadsheet Microsoft: application/vnd.ms-excel application/vnd.openxmlformats-officedocument.spreadsheetml.sheet application/vnd.openxmlformats-officedocument.wordprocessingml.document application/vnd.openxmlformats-officedocument.presentationml.presentation

{% hint style="success" %} You can [customize](#edit-default-lexical-lists) lexical keyword lists according to your organization's requirements.\ Or click [Create new list](#create-new-lexical-lists) to create additional customized lists of keywords. {% endhint %} ## Alerts using lexical lists These lexical lists are leveraged by DoControl to trigger alerts: * **Alert triggers** - Several DoControl alerts are triggered when potentially sensitive files are shared. A file is considered sensitive if: * DoControl's sensitivity model assigns a high score to the file name, or * A customized keyword from the [Alert triggers](/docontrol-user-guide/risk-management/alerts/configure-alerts/configure-global-settings.md#alert-triggers) list is detected in the file name. * **Private email domain list** - Several DoControl alerts are triggered when company files are shared with an actor having a private or non-corporate email domain, such as gmail.com or yahoo.com. | Alert type | Lexical list used | | ------------------------------------------------------- | ------------------------------------------------------------------ | | External sharing of sensitive files (DC3) |

Alert triggers

| | Public sharing of sensitive files (DC6) |

Alert triggers

| | Shared sensitive file with private email (DC7) |

Alert triggers
Private email domain list

| | Shared sensitive file with personal email (DC8) |

Alert triggers
Private email domain list

| | Possible former employee accessed assets (DC30) |

Private email domain list

| | Unprotected sensitive cloud recording is public (DC105) |

Alert triggers

| {% hint style="info" %} For more information about DoControl alerts, go to **Help > DoControl Alert Specifications**. {% endhint %} ## Edit default lexical lists All default lexical lists provided by DoControl can be edited, or customized with unique values. {% hint style="warning" %} * You cannot rename default lists. Any changes you make to a default lexical list will override the default file. * You can add up to 1000 keywords to each lexical list. A counter below the keywords indicates how many keywords you've added to the list. * If you want to add an existing lexical list with more than 1000 items, edit the list before saving. {% endhint %} 1. From the top-right corner in any screen, click **Settings** > **Lexical lists**. 2. From the list to edit, click **Edit**. The lexical list appears on the right. 3. Add or remove keywords, and then click **Save list**. {% hint style="info" %} * You can add multiple-word lexical items with spaces, such as "date of birth" or "credit card." * Lexical list items are **case-sensitive**. DoControl detects the lexical item exactly as it is entered. For example, if the file name includes "Salary" and the lexical list item is "salary" then a match will **not** be found. * After entering each lexical item, click **Enter** or **tab** to add it to the list. Click **X** to remove an item from the lexical list. {% endhint %} 4. To copy all the keywords in a lexical list, click the

**Ellipsis** button above the keywords and select **Copy all**. \ \ ![](https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FPfzcIlzt5AeuROXWKfX9%2Flexical%20list%20functionality.png?alt=media\&token=8fddf224-f2d2-4a58-9ab5-9ad403df6374)
5. To clear all the keywords in a lexical list, click the

**Ellipsis** button above the keywords and select **Clear all**. 6. If you added or removed keywords from a default list, and you want to revert to the original default lexical list, click the

**Ellipsis** button above the keywords and select **Reset to default**.

You can always revert to the default lexical list if you change your mind

## Create new lexical lists You can create your own customized lexical lists to meet your organization's requirements. {% hint style="warning" %} * You can add up to 1000 keywords to each lexical list. A counter below the keywords indicates how many keywords you've added to the list. * If you want to add an existing lexical list with more than 1000 items, edit the list before saving. {% endhint %} 1. From the top-right corner in any screen, click **Settings** > **Lexical lists**. 2. Click **Create new list**. 3. Give your lexical list a name. 4. Add or remove keywords, and then click **Save list**. {% hint style="info" %} * Lexical list items are **case-sensitive**. DoControl detects the lexical item exactly as it is entered. For example, if the file name includes "Salary" and the lexical list item is "salary" then a match will **not** be found. * After entering each lexical item, click **Enter** or **tab** to add it to the list. Click **X** to remove an item from the lexical list. {% endhint %} 5. To copy all the keywords in a lexical list, click the

**Ellipsis** button above the keywords and select **Copy all**. \ \ ![](https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FPfzcIlzt5AeuROXWKfX9%2Flexical%20list%20functionality.png?alt=media\&token=8fddf224-f2d2-4a58-9ab5-9ad403df6374) 6. To clear all the keywords in a lexical list, click the

**Ellipsis** button above the keywords and select **Clear all**. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/system-management/settings/lexical-lists.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.