key word search

A content-inspection technique in which a system or analyst scans data in transit or at rest for the presence of pre-specified terms or strings in order to identify, classify, flag, or block that data based on its substance. It is distinguished from structural or metadata-based inspection by operating on the semantic content of a message or file rather than on headers, labels, or format characteristics — as NIST SP 800-171r3 illustrates by contrasting it with "using document characteristics" as an alternative basis for information-flow decisions. In security and privacy practice it is applied in controls such as data loss prevention (DLP), information-flow enforcement, e-discovery, and content filtering to surface regulated, sensitive, or policy-violating material in large data sets.