# Inquiry about the behavior of the “Apply context rule for” option in Context Detection **URL:** \ **Category:** Endpoint Protector Discussions & Questions\ **Tags:** endpoint-protector, content-aware-protection, context-detection-rules\ **Created:** [April 14, 2026, 8:43am UTC](https://community.netwrix.com/t/inquiry-about-the-behavior-of-the-apply-context-rule-for-option-in-context-detection/128158 "2026-04-14T08:43:41Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![jwkim](https://avatars.discourse-cdn.com/v4/letter/j/4491bb/32.png) [@jwkim](https://community.netwrix.com/u/jwkim)\ **Post date:** [April 14, 2026, 8:43am UTC](https://community.netwrix.com/t/inquiry-about-the-behavior-of-the-apply-context-rule-for-option-in-context-detection/128158/1 "2026-04-14T08:43:41Z")
**Before posting, I would like to provide the following details for more accurate assistance:** **1. What version are you using? (OS, client, server, etc.)** → We are currently using Windows and macOS. **2. What settings/configuration do you currently have in place?** → We are currently testing the Context Detection feature. Specifically, we are trying to understand the exact behavior of the _“Apply context rule for”_ setting. **3. What unexpected behavior are you seeing?** → Based on our understanding: - _All items in scanned document_: the policy should apply only if all specified items in the Included Context are present. - _At least one item in scanned document_: the policy should apply if at least one of the specified Included Context items is present. However, in our testing: - When the Included Context condition is set to **OR** , the policy seems to apply as long as at least one item is present, regardless of the _Apply context rule for_ setting. - When the Included Context condition is set to **AND** , the policy applies only when all specified items are present, as expected. This makes us unclear about the actual purpose and behavior of the _Apply context rule for_ option. We suspect there may be a misunderstanding on our side, so we would appreciate it if you could provide a detailed explanation of how this feature works. **4. What have you tried so far?** → We have been continuously testing different configurations to reproduce and understand the behavior. ---
**Author:** ![AaronDunn](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@AaronDunn](https://community.netwrix.com/u/AaronDunn)\ **Post date:** [April 17, 2026, 7:52pm UTC](https://community.netwrix.com/t/inquiry-about-the-behavior-of-the-apply-context-rule-for-option-in-context-detection/128158/2 "2026-04-17T19:52:17Z")
Good question. The **Included Context: AND | OR** switch controls how the context keywords are applied when two or more context dictionaries are selected. AND requires a keyword from each dictionary to be present. If you select just one dictionary, it does not perform an AND on all the keywords within that dictionary. (I.e., the switch does nothing in the case where there is only one dictionary.) For example, I created two dictionaries: ‘SSN1’ with only the keyword ‘SSN’ and ‘SSN2’ with only the keyword ‘Social Security Number’. My policy had **ssn/us** with a **Threat Threshold** of 2. My **Included Context** had ‘Custom Content/SSN1’ **AND** ‘Custom Content/SSN2’. My context rule had **Proximity** =50 (important later). This was blocked: > SSN > Social Security Number > 123-45-6789 > 234-56-7890 This was not blocked: > SSN > 123-45-6789 > 234-56-7890 I then configured just one context dictionary combining both keywords ‘SSN’ and ‘Social Security Number’. Then both of the above documents were blocked. (Both keywords from the same dictionary were not required.) The **Apply context rule for** switch controls how the contextual rule is applied to _multiple threats_ (e.g. SSNs) within the same document. I now put padding characters (\>50) between the two SSNs, _both with context_, like this: > SSN > Social Security Number > 123-45-6789 > > ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 > ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 > > SSN > Social Security Number > 234-56-7890 and the same, but with _context near only one of the SSNs_, like this: > SSN > Social Security Number > 123-45-6789 > > ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 > ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 > > 234-56-7890 With **All items in scanned document** , only the first document is blocked–the ‘234-56-7890’ in the second document has no context, so it is not counted and the document does not reach the threat threshold of 2. With **At least one item in scanned document** , both documents are blocked–having found ‘123-45-6789’ in context, it then counts _every_ SSN numeric pattern regardless of context. I hope this was clear! ---
**Author:** ![jwkim](https://avatars.discourse-cdn.com/v4/letter/j/4491bb/32.png) [@jwkim](https://community.netwrix.com/u/jwkim)\ **Post date:** [April 22, 2026, 1:56am UTC](https://community.netwrix.com/t/inquiry-about-the-behavior-of-the-apply-context-rule-for-option-in-context-detection/128158/3 "2026-04-22T01:56:12Z")
Hello, @AaronDunn Thanks to your explanation, I now fully understand. Thank you for the detailed explanation! ---
**Author:** ![system](https://yyz1.discourse-cdn.com/netwrix/user_avatar/community.netwrix.com/system/32/3102_2.png) [@system](https://community.netwrix.com/u/system)\ **Post date:** [June 21, 2026, 1:56am UTC](https://community.netwrix.com/t/inquiry-about-the-behavior-of-the-apply-context-rule-for-option-in-context-detection/128158/4 "2026-06-21T01:56:14Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.