Glasswall Halo protects NITF (National Imagery Transmission Format) and NSIF (NATO Secondary Imagery Format) files with Glasswall Genesis. You control that protection through the optional `extendedFormatSettings` section of a content management policy, by setting the action Genesis takes for each rule. This page explains the section, lists every rule with its default action and describes the default behavior you will see in protected files.

The section is managed through the Policy management API and the dynamic policy of a CDR request. It does not appear in the Halo Portal in this release. For the policy endpoints and the three ways to apply a policy, see [Define content management policies](/rest-api/define-content-management-policies).

## The default

A newly created or reset policy carries an empty policy tree:

```json
"extendedFormatSettings": {
  "version": 1,
  "policy": {}
}
```

An empty tree, or no `extendedFormatSettings` section at all, means Genesis applies its own default action to every rule. The default for each rule is listed in the [NITF rule reference](#nitf-rule-reference).

## Example

Each entry under `rules` names a rule, by its name or its ID, and gives the one action it takes. Every rule you do not name keeps its default.

```json
"extendedFormatSettings": {
  "version": 1,
  "policy": {
    "cdr": {
      "overrides": {
        "nitf": {
          "rules": {
            "originator-name-disclosure": "report",
            "originator-phone-disclosure": "report",
            "gw-7NHJA9B": "report",
            "image-subheader-unaccounted-bytes": "remove"
          }
        }
      }
    }
  }
}
```

This policy keeps the originator name and phone fields and the file title, which Genesis would otherwise overwrite, and removes surplus bytes from image subheaders, which Genesis would otherwise only report.

## Settings reference

### Envelope

| Setting | Type | Default | Effect |
|---|---|---|---|
| `version` | integer | `1` | The version of the section's shape. Always `1` in this release. |
| `policy` | object | `{}` | The Genesis policy tree. Halo hands it to Genesis unchanged. Empty means Genesis defaults. |

### Policy tree

| Setting | Where | Effect |
|---|---|---|
| `cdr` | `policy` | The Glasswall CDR (Content Disarm and Reconstruction) decisions. This is the only section Halo enforces. |
| `overrides` | `policy.cdr` | Per-format settings, keyed by format. The format keys are `nitf` for the NITF or NSIF file itself, and `jpeg`, `jpeg2000`, `emf`, `wmf`, `h264`, `h265` and `sidd` for the content embedded in it. Any other key is rejected when the policy is saved. |
| `rules` | `overrides.<format>` | The action for individual rules, keyed by rule name or rule ID. The value is one action, written as a string. The rule must offer the action you name, or the policy fails when Genesis loads it. |

The section also accepts scope-wide settings such as `globals`, `compliance` and per-content-type `actions`. They are not covered in this release.

### Actions

| Action | Effect |
|---|---|
| `report` | Record the finding in the analysis report and deliver the file with the content unchanged. |
| `reveal` | Make hidden content visible. No NITF rule offers this action in this release. |
| `replace` | Overwrite the content with a safe value, for example spaces or a default. |
| `remove` | Remove the content and correct the lengths that described it. |
| `reject` | Block the file. The file is not delivered and the report gives the reason. Every rule offers this action. |
| `omit` | Do not run the rule. Nothing is reported and nothing is changed. |

Setting `null` for a rule is the same as leaving it out.

## How a rule's action is decided

A rule takes the action its `rules` entry names. Without an entry it takes its default. A rule that offers only `reject`, such as `image-subheader-length-mismatch`, cannot be changed, and a policy naming another action for it is rejected when Genesis loads it. Where several rules act on the same field, they run in order and the last one sets the final value.

## Default behavior you will see in output

Some rules change a field on every protected file, and some fields are handled in ways that cannot be configured.

- **Originator name and phone** (ONAME, OPHONE) are overwritten with spaces on every protected file. Set `originator-name-disclosure` and `originator-phone-disclosure` to `report` to keep them.
- **File title, text segment titles and graphic names** (FTITLE, TXTITL, SNAME) are replaced because they can carry sensitive free text. Set `file-title-disclosure`, `text-title-disclosure` or `graphic-name-disclosure` to `report` to keep them.
- **Encryption flag** (ENCRYP) is never rewritten. A file whose flag is set to anything other than `0` is blocked, because clearing it would deliver a file that claims to be unencrypted while carrying the original bytes. To take delivery of such a file, set `encryption-flag-invalid` and `encryption-flag-segment-invalid` to `report`. A blank flag is treated as unset, and its departure from the numeric character set is reported by `header-numeric-charset-invalid`.
- **Image sync** (ISYNC) is overwritten with zero and the file is delivered. Set `image-sync-invalid` to `reject` to block such a file instead.
- **Reserved segment count** (NUMX) blocks the file when it is not `000`. Set `label-segment-count-out-of-range` to `replace` to have it overwritten and the file delivered, or to `report` to deliver the file unchanged.
- **Copy numbers** (FSCOP, FSCPYS) are overwritten with `00000` on every protected file by `copy-numbers-non-default`. Because the block decision reads the corrected output, that overwrite also satisfies `copy-numbers-not-integer`, so a `reject` on that rule only takes effect where the overwrite is suppressed. To block on non-default copy numbers, set `copy-numbers-non-default` itself to `reject`.
- **Image subheader length.** Where an image subheader's fields need more space than the declared length provides, `image-subheader-length-mismatch` blocks the file, and that cannot be changed. Where the declared length exceeds the fields, `image-subheader-unaccounted-bytes` reports the surplus by default. Setting it to `remove` deletes the surplus and corrects the subheader and file lengths, which shortens the file. Some producers pad subheaders, so the reporting default is recommended unless the surplus must go.
- **Compressed images, CGM (Computer Graphics Metafile) graphics and SIDD (Sensor Independent Derived Data) segments** are handed to the matching embedded format by the rules `compressed-image-present`, `cgm-content-present` and `des-data-present`. Setting one of them to `report` delivers that content uninspected.
- **Output integrity.** After protection, Genesis re-reads every output file and refuses to deliver one it can no longer parse as valid NITF. This check cannot be turned off.
- **SIDD and other XML segments.** A SIDD segment that cannot be protected blocks the whole file with the reason `unsupported-variant`, and this is not configurable. A non-SIDD XML segment such as SICD is blocked by `unsupported-xml-des`, which you can downgrade to `report` to pass the segment through uninspected.

Choosing a non-modifying action such as `report` or `reject` for a rule turns off the replacement that rule owns, so the field is delivered as it arrived.

### Declassification fields and the classification text field

The `declass-fields-present` rule clears the declassification fields when the element is unclassified or declares no declassification type, following the Inspection and Sanitization Guidance. The guidance groups six fields for this purpose: the declassification type, date and exemption, the downgrade indicator and its date and the classification text field (xSCLTX).

Genesis clears the first five and **filters** the sixth rather than clearing it. The classification text field is where a file records dissemination caveats when the control-and-handling field holds `CH`, and where codeword and releasability overflow is held. A blank declassification type is the specification's default, so clearing the field on that basis would strip caveats from classified products that simply never declared a declassification scheme.

The filter keeps only the formatted values the guidance defines for the field, and only when the field that declares the overflow agrees:

- A `CW_` codeword overflow, when the codewords field ends in `+`.
- An `RL_` releasability overflow, when the releasability field ends in `+`.
- `CH_` caveats or `SIC:` indicator codes, when the control-and-handling field holds `CH`.
- Either "CANNOT BE EXPRESSED IN SUBHEADER" declaration.

Everything else in the field is cleared. In practice this means dissemination caveats survive processing, free text in the field is still removed and a field holding a caveat followed by free text is rewritten to the caveat alone. `classification-text-disclosure` reports the original content before processing.

To have the declassification fields reported instead of cleared, set `declass-fields-present` to `report`. Setting `classification-text-disclosure` to `reject` blocks any file whose classification text field carries content, because it is a presence check with no replacement available.

## Embedded content

A NITF or NSIF file can carry images, graphics and video that Genesis inspects with the format's own rules. You set their actions in the same way, under `overrides.<format>.rules`, where the format is `jpeg`, `jpeg2000`, `emf`, `wmf`, `h264`, `h265` or `sidd`. Every rule for these formats, with its default action, is listed in [NITF and NSIF embedded content rules](/halo/nitf-nsif-embedded-content-rules).

These settings apply only to content inside a NITF or NSIF file. A standalone file of one of these formats is not processed by Genesis. Where the Glasswall Embedded Engine supports the format, it is configured through `contentManagementFlags` instead.

## Validation and errors

Halo checks the `cdr` section against the settings and values Genesis accepts before it stores a policy or accepts a request.

- An unknown setting or a value outside the allowed set is rejected with error code `4004` and a message naming the path to the setting at fault.
- An `overrides` key that is not one of the eight formats is rejected when the policy is saved.
- Rule names are not checked by Halo. A name Genesis does not recognize, or an action the rule does not offer, is found when Genesis loads the policy. Every NITF or NSIF file submitted under that policy is then errored with the reason `GenesisPolicyInvalid` until the policy is corrected.
- The policy is read for every request, so a change takes effect for the next submission without redeploying or restarting Halo.

## NITF rule reference

Every rule Genesis applies to the NITF structure, grouped by the part of the file it checks. Target a rule under `rules` by its name or its ID. `reject` is offered by every rule and is not repeated in the **Configurable actions** column. **Compliance** lists the sources that back the rule: `spec` is the format specification, `isg` is the NSA Inspection and Sanitization Guidance, `cve` is a published vulnerability, `gw` is Glasswall research. **Impact** is the rule's change tier.

### `allowed-character-sets-size`

If any byte in a file header field falls outside the declared character set, it may indicate data hiding, corruption or an attack vector. Fields using BCS-A, BCS-N, BCS-N PI and ECS-A each have specific allowed byte ranges defined by the NITF specification.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `file-datetime-charset-invalid` | `gw-KBZF59J` | Detect BCS-N fields containing characters other than digits, plus, minus, period or slash | `reject` | `report` `omit` | spec; isg; gw | functional |
| `file-header-fields-charset-invalid` | `gw-MJ1JYW4` | Detect BCS-A fields containing bytes outside the range 0x20-0x7E | `reject` | `report` `omit` | spec; isg; gw | functional |
| `header-length-charset-invalid` | `gw-77NRM2F` | Detect a file length or header length field containing characters other than digits | `reject` | `report` `omit` | spec; isg; gw | functional |
| `header-numeric-charset-invalid` | `gw-D5RH2V3` | Detect a complexity level, copy number or encryption field with characters other than digits | `report` | `report` `omit` | spec; isg; gw | functional |
| `header-text-fields-charset-invalid` | `gw-VBGAZ4P` | Detect ECS-A fields containing bytes outside the ranges 0x20-0x7E or 0xA0-0xFF | `reject` | `report` `omit` | spec; isg; gw | functional |

### `band-representation`

Inconsistent band representation descriptors may indicate a manipulated file designed to hide content in bands that standard viewers ignore.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `band-count-inconsistent` | `gw-62P1GAJ` | Detect a band count (NBANDS/XBANDS) inconsistency: NBANDS outside 0-9, or XBANDS missing when NBANDS is 0 | `reject` | `report` `omit` | spec; isg; gw | functional |
| `band-representation-invalid` | `gw-B33PP90` | Detect band representation (IREPBANDn) values inconsistent with IREP | `reject` | `report` `omit` | spec; isg; gw | functional |
| `band-subcategory-invalid` | `gw-YA9NG6W` | Detect band subcategory (ISUBCATn) values inconsistent with ICAT and IREP (Table 5.13-8) | `reject` | `report` `omit` | spec; isg; gw | functional |
| `lookup-table-embedded-file` | `gw-H0HJXKX` | Detect a file signature embedded in a band lookup table's entries | `reject` | `report` `omit` | isg; gw | functional |
| `lookup-table-size-invalid` | `gw-988T966` | Detect a band lookup table whose declared size is outside what the spec permits | `reject` | `report` `omit` | spec; isg; gw | functional |

### `classification`

Invalid classification values or missing classification system codes may indicate manipulation or cause mishandling of classified information. Security classification fields may contain sensitive information about classification handling and releasability.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `classification-level-inconsistent` | `gw-TX2K4D9` | Detect a segment classification that exceeds the file header classification (U &lt; R &lt; C &lt; S &lt; T) | `reject` | `report` `omit` | spec; isg; gw | functional |
| `classification-level-invalid` | `gw-E2HB506` | Detect an xSCLAS value other than T, S, C, R or U in the file header or any segment subheader | `reject` | `report` `omit` | spec; isg; gw | functional |
| `classification-system-bare-country-invalid` | `gw-ZCFM2D6` | Detect an xSCLSY bare country code that is neither valid a priori (uppercase A-Z only) nor ad hoc (letters and digits) format | `reject` | `report` `omit` | spec; isg; gw | functional |
| `classification-system-conditional-invalid` | `gw-VRBP79T` | Detect an xSCLSY of spaces when xSCLAS is T/S/C/R (classified) | `reject` | `report` `omit` | spec; isg; gw | functional |
| `classification-system-country-invalid` | `gw-P9RVRXR` | Detect an xSCLSY that is not a valid 2-byte country code (uppercase A-Z), special code (XN/XF/YY/UU) or spaces when unclassified | `reject` | `report` `omit` | spec; isg; gw | functional |
| `classification-text-country-invalid` | `gw-YX23VPP` | Detect an xSCLTX fully specified country code URN with invalid concept-type, authority, encoding, baseline or code components | `reject` | `report` `omit` | spec; isg; gw | functional |
| `codewords-disclosure` | `gw-W7SFNG0` | Detect codewords (xSCODE) carrying content the conformance check does not constrain | `report` | `report` `omit` | isg; gw | functional |
| `codewords-invalid` | `gw-5BGEHYE` | Detect an xSCODE that is not spaces, ISM-IN-TRE-, ISM-IN-FHDR or space-separated codewords of printable characters | `reject` | `report` `omit` | spec; isg; gw | functional |
| `control-handling-invalid` | `gw-EH9AHWG` | Detect an xSCTLH that is neither spaces nor 2 BCS-A printable characters | `reject` | `report` `omit` | spec; isg; gw | functional |
| `control-handling-marking-conflict` | `gw-8HVEZYX` | Detect an xSCTLH of CH while xSCODE stores the markings externally | `report` | `report` `omit` | spec; gw | functional |
| `control-handling-overflow-missing` | `gw-KSHF9Z2` | Detect an xSCTLH of CH whose xSCLTX is not a CH_ or SIC: code overflow | `report` | `report` `omit` | spec; gw | functional |
| `releasing-instructions-invalid` | `gw-06P0AXY` | Detect an xSREL that is not spaces, hash-fill or space-separated bare country codes (2-3 uppercase A-Z chars, 20th char may be +) | `reject` | `report` `omit` | spec; isg; gw | functional |
| `segment-codewords-undeclared` | `gw-JA5C7JV` | Detect codewords in a segment subheader that the file header does not declare | `report` | `report` `omit` | gw | functional |
| `segment-control-handling-undeclared` | `gw-TC4KJXP` | Detect control and handling markings in a segment subheader that the file header does not declare | `report` | `report` `omit` | gw | functional |
| `segment-releasability-undeclared` | `gw-1DFE95G` | Detect releasing instructions in a segment subheader that the file header does not declare | `report` | `report` `omit` | gw | functional |

### `classification-authority`

Invalid classification authority fields may indicate file manipulation or cause improper attribution of classification decisions. Classification authority field may contain personally identifiable information about the classifying official.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `authority-type-invalid` | `gw-BH8SF9K` | Detect an xSCATP other than O, D, M or space | `reject` | `report` `omit` | spec; isg; gw | functional |
| `classification-authority-disclosure` | `gw-EZ337WV` | Detect classification authority (xSCAUT) carrying free text that requires review | `report` | `report` `omit` | isg; gw | functional |
| `classification-reason-invalid` | `gw-HTW43F6` | Detect an xSCRSN other than A-H, M, N or space | `reject` | `report` `omit` | spec; isg; gw | functional |
| `copy-number-inconsistent` | `gw-VS8J12T` | Detect a file copy number (FSCOP) greater than the file number of copies (FSCPYS) | `reject` | `report` `omit` | spec; isg; gw | functional |
| `security-source-date-invalid` | `gw-93KG1R2` | Detect an xSSRDT that is neither a valid CCYYMMDD nor all spaces | `reject` | `report` `omit` | spec; isg; gw | functional |

### `data-extension-segment`

DES subheader fields may contain forged data. DE must be 'DE', DESID must be printable and DESVER must be valid.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `des-body-opaque` | `gw-KZ1JQSM` | Detect a non-SIDD DES carrying an opaque, uninspectable body | `report` | `report` `replace` `omit` | isg; gw | functional |
| `des-body-smuggling-signal` | `gw-6V4DAZG` | Detect a non-SIDD DES body (DESDATA/DESSHF) carrying a content-smuggling signal | `report` | `report` `replace` `omit` | spec; isg; gw | functional |
| `des-data-embedded-file` | `gw-FFK1XHH` | Detect Data Extension Segment data carrying an embedded file signature other than markup | `reject` | `report` `omit` | spec; isg; gw | functional |
| `des-data-embedded-markup` | `gw-PHN7MJV` | Detect Data Extension Segment data carrying an embedded XML or HTML signature | `report` | `report` `omit` | isg; gw | functional |
| `des-data-entropy-suspicious` | `gw-AS5VX71` | Detect DES data with anomalously high entropy indicating hidden or encrypted content | `report` | `report` `omit` | spec; isg; gw | functional |
| `des-data-null-padding` | `gw-15MB867` | Detect DES data carrying null padding that may conceal hidden content | `report` | `report` `omit` | spec; isg; gw | functional |
| `des-data-present` | `gw-C63HQ8A` | Detect SIDD (Sensor Independent Derived Data) DES segments (DESID 'XML_DATA_CONTENT' with SIDD subspec) whose embedded XML requires sub-camera inspection | `replace` | `replace` `report` `omit` | isg; gw | functional |
| `des-data-printable-ratio-suspicious` | `gw-6QV26WK` | Detect DES data with an anomalous printable-character ratio | `report` | `report` `omit` | spec; isg; gw | functional |
| `des-id-invalid` | `gw-DVR7GTC` | Detect a DES identifier (DESID) containing non-BCS-A bytes | `report` | `report` `omit` | spec; isg; gw | functional |
| `des-identifier-spoofed` | `gw-QRQM2BN` | Detect a DES identifier (DESID) impersonating a dedicated-handler identifier through non-conformant padding | `reject` | `report` `omit` | spec; gw | functional |
| `des-name-collision-set` | `gw-SXAC10Y` | Detect XML element names chosen to share a hash value, degrading a consumer's lookup | `report` | `report` `omit` | spec; isg; gw | structural |
| `des-subheader-length-mismatch` | `gw-8285Q3F` | Detect a DES subheader length (LDSH) that disagrees with the length DESSHL implies | `reject` | `report` `omit` | spec; isg; gw | functional |
| `des-type-invalid` | `gw-3B8RZ5S` | Detect a DES subheader file part type (DE) other than 'DE' | `report` | `report` `omit` | spec; isg; gw | functional |
| `des-unregistered` | `gw-GP8DGJ5` | Detect a DES identifier (DESID) that is not registered in the NTB FV-CP register | `report` | `report` `omit` | spec; isg; gw | functional |
| `des-user-header-field-invalid` | `gw-CAZQ6YD` | Detect an XML DES user-defined subheader subfield that violates its declared type or range | `report` | `report` `omit` | spec; gw | functional |
| `des-user-header-length-invalid` | `gw-TWEAMEM` | Detect an XML DES user-defined subheader length that is not a defined inclusion stage | `report` | `report` `omit` | spec; gw | functional |
| `des-version-invalid` | `gw-H3SJZT6` | Detect a DES version (DESVER) that is not a valid 2-digit version number (01-99) | `report` | `report` `omit` | spec; isg; gw | functional |
| `multiple-sidd-des` | `gw-WY5HYF6` | Detect a container declaring more than one SIDD XML data extension segment | `report` | `report` `omit` | isg; gw | functional |
| `streaming-des-field-unsupported` | `gw-39QNDBX` | Detect a STREAMING_FILE_HEADER present in any DES DESID field | `reject` | `report` `omit` | spec; isg; gw | functional |
| `unsupported-xml-des` | `gw-NTFXDES` | Detect an XML_DATA_CONTENT / SIDD_XML DES whose XML root is not a SIDD namespace (an unsupported variant such as SICD that the SIDD sub-camera cannot inspect or remediate) | `reject` | `report` `omit` | isg; gw | functional |

### `declassification`

Invalid declassification fields may indicate file manipulation or cause mishandling of declassification schedules. Classification text may contain sensitive information about classification reasoning and authority.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `classification-text-disclosure` | `gw-J0N4J9J` | Detect classification text (xSCLTX) carrying free text that requires review | `report` | `report` `omit` | isg; gw | functional |
| `declass-date-conditional-invalid` | `gw-9PJZBJ4` | Detect an xSDCDT of spaces when xSDCTP is DD or DE | `reject` | `report` `omit` | spec; isg; gw | functional |
| `declass-date-format-invalid` | `gw-64DJ90Q` | Detect an xSDCDT that is neither a valid CCYYMMDD nor all spaces | `reject` | `report` `omit` | spec; isg; gw | functional |
| `declass-exemption-invalid` | `gw-JN916GM` | Detect an xSDCXM that is not a valid exemption code when xSDCTP is X(space) | `reject` | `report` `omit` | spec; isg; gw | functional |
| `declass-fields-present` | `gw-Y605Q6J` | Detect declassification fields (FSDCTP, FSDCDT) populated when classification is U or the declassification type is not implemented | `replace` | `replace` `report` `omit` | isg; gw | functional |
| `declass-type-invalid` | `gw-0B1ZGMN` | Detect an xSDCTP other than DD, DE, GD, GE, O(space), X(space) or spaces | `reject` | `report` `omit` | spec; isg; gw | functional |
| `downgrade-date-conditional-invalid` | `gw-C209SXH` | Detect an xSDGDT that is not a valid CCYYMMDD when xSDG is S/C/R | `reject` | `report` `omit` | spec; isg; gw | functional |
| `downgrade-invalid` | `gw-5J4ZJJX` | Detect an xSDG other than S, C, R or space | `reject` | `report` `omit` | spec; isg; gw | functional |
| `downgrade-level-inconsistent` | `gw-516Q559` | Detect an xSDG naming a classification at or above xSCLAS | `reject` | `report` `omit` | spec; isg; gw | functional |
| `downgrade-without-declass-type` | `gw-Y5TG33S` | Detect an xSDG populated while xSDCTP is neither GD nor GE | `reject` | `report` `omit` | spec; isg; gw | functional |

### `encryption`

Encrypted NITF files cannot be inspected or protected. ENCRYP is defined in the file header (offset 296) and in the Image, Graphic and Text subheaders only; MIL-STD-2500C tables A-8 and A-9 give the DES and RES subheaders no such field. A populated value other than 0 declares the payload to be ciphertext and the file is rejected, since clearing the flag would not decrypt the content and would deliver a file declaring itself unencrypted while carrying the original bytes. An all-spaces field declares nothing and is treated as unset; its departure from BCS-N PI is reported by header-numeric-charset-invalid.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `encryption-flag-invalid` | `gw-T5C81WM` | Detect a file header encryption flag (ENCRYP) declaring the payload encrypted | `reject` | `report` `omit` | spec; isg; gw | functional |
| `encryption-flag-segment-invalid` | `gw-GHXDFVA` | Detect an encryption flag (ENCRYP) declaring an Image, Graphic or Text payload encrypted | `reject` | `report` `omit` | spec; isg; gw | functional |

### `extended-header-data`

The Extended Header Data fields (XHDL, XHDLOFL, XHD) allow additional TRE data in the file header. Invalid length values or overflow references to non-existent DES segments can hide data or cause incorrect parsing. Extended Header Data (XHD) may contain TRE data with sensitive or classified information that requires external filtering before release.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `ext-header-length-out-of-range` | `gw-XF0T67K` | Detect an extended header data length (XHDL) that is neither 0 nor within 3-99999 | `reject` | `report` `omit` | spec; isg; gw | functional |
| `ext-header-overflow-invalid` | `gw-RM0YJJQ` | Detect an extended header overflow reference (XHDLOFL) that does not reference a valid DES segment | `reject` | `report` `omit` | spec; isg; gw | functional |
| `ext-header-present` | `gw-K3K2J3Y` | Detect extended header (XHD) TRE data that may carry sensitive information | `report` | `report` `omit` | isg; gw | functional |

### `file-length-and-header-length`

Data can be appended to NITF files by manipulating the FL field to be smaller than the actual file size. Mismatched header length values may indicate malicious modification of the file structure. Applications rely on FL and HL being accurate for correct parsing.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `complexity-level-size-exceeded` | `gw-ZZGFZ82` | Detect a file size (FL) exceeding the maximum allowed by the declared complexity level (CLEVEL) per Table G-1 | `report` | `report` `omit` | spec; isg; gw | functional |
| `file-length-mismatch` | `gw-HYP7KVG` | Detect a file length (FL) that does not match the actual file size | `reject` | `report` `omit` | spec; isg; gw | functional |
| `file-length-out-of-range` | `gw-VG7SDKE` | Detect a file length (FL) outside the allowed range (388 to 999999999998) | `reject` | `report` `omit` | spec; isg; gw | functional |
| `header-length-mismatch` | `gw-A2C0B97` | Detect a header length (HL) that does not match the computed header length (skipped when HL is 999999, streaming mode) | `reject` | `report` `omit` | spec; isg; gw | functional |
| `header-length-out-of-range` | `gw-QY07JKC` | Detect a header length (HL) outside the allowed range (388 to 999999) | `reject` | `report` `omit` | spec; isg; gw | functional |

### `graphic-cgm-structure`

CGM graphic data may contain malformed element streams, reserved element classes or security-sensitive Escape (class 6) and Application Data (class 7) elements that can carry arbitrary vendor-specific operations or payloads.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `cgm-content-present` | `gw-CGMEMB3` | Detect graphic segments carrying WMF / EMF metafile data whose content requires sub-camera inspection | `replace` | `replace` `report` `omit` | isg; gw | functional |
| `cgm-structure-invalid` | `gw-VZ7D0W5` | Detect a CGM element stream with a structural-integrity fault, missing delimiter or security-sensitive element | `reject` | `report` `omit` | spec; isg; gw | functional |

### `graphic-extended-data`

SXSHDL defines the size of extended subheader data in graphic segments. Values of 1 or 2 are invalid (must be 0 or 3-99999). Manipulated lengths can cause parsers to read incorrect data. SXSHD TRE data may contain sensitive information that requires external filtering.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `graphic-ext-header-disclosure` | `gw-64JA1PW` | Detect graphic extended-subheader (SXSHD) TRE free-text content that may carry sensitive information | `report` | `report` `omit` | spec; isg; gw | functional |
| `graphic-ext-header-length-invalid` | `gw-C903W2A` | Detect a graphic extended-subheader data length (SXSHDL) that is neither 0 nor 3-99999 in any graphic subheader | `report` | `report` `omit` | spec; isg; gw | functional |

### `graphic-subheader`

Graphic subheader fields may contain forged or hidden data. SY must be 'SY', SFMT must be 'C' and SSTRUCT must be all zeros. SID and SNAME may disclose sensitive identification information.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `graphic-format-structure-non-default` | `gw-JA74Q9R` | Detect a graphic format (SFMT) other than 'C' (CGM) or a structure (SSTRUCT) other than 13 zeros | `replace` | `replace` `report` `omit` | spec; isg; gw | functional |
| `graphic-id-name-disclosure` | `gw-8A9BJZ3` | Detect graphic identifier (SID) and name (SNAME) free-text content that may carry sensitive information | `report` | `report` `omit` | spec; isg; gw | functional |
| `graphic-name-disclosure` | `gw-853KZBR` | Detect a graphic name (SNAME) that may carry sensitive information | `replace` | `replace` `report` `omit` | isg; gw | visual |
| `graphic-partition-invalid` | `gw-BE2E2K6` | Detect a graphic subheader file part type (SY) other than 'SY' | `report` | `report` `omit` | spec; isg; gw | functional |

### `header-first-119-bytes`

Based on experimentation with uncertified NITF viewers, it appears the only field required to be accurate is the File Profile Name, which should be "NITF". The next bytes of this header portion do not appear to have a significant impact on the file when opening it, so they could contain hidden data or malicious content. The Complexity Level signals to the application the complexity of the file and the requirements necessary to process the file; manipulation of this field may impact the ability for NITF files to be processed by certain applications. Uncertified applications should not be used to process or render NITF files as they can create and/or persist non-compliant NITF files. The NITF header contains the fields Originator's Name, Originator's Phone Number, Originating Station ID and the File Title. All of these fields could contain sensitive information.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `complexity-level-invalid` | `gw-NCTA52A` | Detect a CLEVEL that does not evaluate to 03, 05, 06, 07, 09, 51, 54 or 57 (any other value is non-compliant; values 51, 54 and 57 imply the file uses the Motion Imagery Extension (MIE4NITF); Table G-1 in JBP 2024.1 covers additional constraints on subsequent constructs based on the value of CLEVEL) | `reject` | `report` `omit` | spec; isg; gw | functional |
| `copy-numbers-non-default` | `gw-HMWEEN3` | Detect a file copy number (FSCOP) / file number of copies (FSCPYS) carrying non-default copy-tracking values | `replace` | `replace` `report` `omit` | isg; gw | functional |
| `copy-numbers-not-integer` | `gw-06RZ9KC` | Detect a file copy number (FSCOP) or file number of copies (FSCPYS) that is not a positive integer | `reject` | `report` `omit` | spec; isg; gw | functional |
| `file-datetime-cross-segment-invalid` | `gw-7JAT2XP` | Detect a file date/time (FDT) earlier than an image (IDATIM) or text (TXTDT) date/time | `reject` | `report` `omit` | spec; isg; gw | functional |
| `file-datetime-invalid` | `gw-EF4XAH4` | Detect a date field (FDT) that is not in the correct UTC format of CCYYMMDDhhmmss | `reject` | `report` `omit` | spec; isg; gw | functional |
| `file-header-invalid` | `gw-YGWDXM2` | Detect a file profile name (FHDR) other than NITF or NSIF in the first 4 bytes | `reject` | `report` `omit` | spec; isg; gw | functional |
| `file-title-disclosure` | `gw-7NHJA9B` | Detect a file title (FTITLE) that may carry sensitive free text | `replace` | `replace` `report` `omit` | isg; gw | visual |
| `nitf-file-version-invalid` | `gw-WT6EGQ3` | Detect a file version (FVER) other than 02.10 when the file profile name (FHDR) is NITF | `reject` | `report` `omit` | spec; isg; gw | functional |
| `nsif-file-version-invalid` | `gw-RW8EGH5` | Detect a file version (FVER) other than 01.01 or 01.00 when the file profile name (FHDR) is NSIF | `reject` | `report` `omit` | spec; isg; gw | functional |
| `originator-fields-disclosure` | `gw-31ANKNT` | Detect originator name (ONAME), phone (OPHONE), station ID (OSTAID) and file title (FTITLE) free-text content that may carry sensitive information | `report` | `report` `omit` | spec; isg; gw | functional |
| `standard-type-invalid` | `gw-6RP2YBG` | Detect a standard type (STYPE) field other than "BF01" | `reject` | `report` `replace` `omit` | spec; isg; gw | functional |

### `image-block-structure`

Block structure inconsistency (NBPR\*NPPBH &lt; NCOLS or NBPC\*NPPBV &lt; NROWS) causes downstream decoders to miscalculate buffer sizes, potentially leading to heap buffer overflow or under-read.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `block-cols-mismatch` | `gw-B4ESDK9` | Detect vertical block coverage (NBPC \* NPPBV) less than the image height (NROWS) | `report` | `report` `omit` | spec; isg; gw | functional |
| `block-count-mismatch` | `gw-Q4XHWNK` | Detect a number of blocks per row (NBPR) or per column (NBPC) below 1 | `report` | `report` `omit` | spec; isg; gw | functional |
| `block-rows-mismatch` | `gw-KY9HQSY` | Detect horizontal block coverage (NBPR \* NPPBH) less than the image width (NCOLS) | `report` | `report` `omit` | spec; isg; gw | functional |

### `image-comments`

Image comments (ICOM fields) may contain hidden data via non-printable characters. Each ICOM must consist of BCS-A printable characters (0x20-0x7E). Image comments may contain sensitive information that requires external filtering.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `image-comment-charset-invalid` | `gw-6JG38N8` | Detect an image comment (ICOM) containing characters other than BCS-A printable (0x20-0x7E) | `report` | `report` `omit` | spec; isg; gw | functional |
| `image-comment-disclosure` | `gw-DNXMCC0` | Detect image comment (ICOM) free-text content that may carry sensitive information | `report` | `report` `omit` | spec; isg; gw | functional |

### `image-compression`

Invalid compression codes, missing mask tables or malformed COMRAT values may indicate a manipulated image or trigger codec vulnerabilities.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `codestream-trailing-data-present` | `gw-C36XZW6` | Detect data appended after the JPEG 2000 codestream EOC | `replace` | `replace` `report` `omit` | spec; gw | structural |
| `compressed-geometry-mismatch` | `gw-W70TCXD` | Detect a compressed image whose codestream declares a different picture than its subheader | `reject` | `report` `omit` | spec; isg; gw | functional |
| `compressed-image-present` | `gw-NTFEMB5` | Detect compressed image segments (IC in C3, M3, C5, M5, C8, M8) whose pixel data requires sub-camera inspection | `replace` | `replace` `report` `omit` | isg; gw | visual |
| `compression-code-invalid` | `gw-FWSZF1Z` | Detect an image compression code (IC) that is not a permitted value | `reject` | `report` `omit` | spec; isg; gw | functional |
| `compression-codec-unsupported` | `gw-K4WQ2M8` | Detect an image segment whose compression code (IC) is a compressed codec Genesis has no sub-camera to inspect (e.g. C1 bi-level, C4 vector quantization); the codestream cannot be made safe, so protect fails closed rather than blanking the pixels while reporting clean | `reject` | `report` `omit` | spec; gw | functional |
| `compression-mask-table-present` | `gw-9Q07H96` | Detect a masked image compression (IC) without a readable mask table header | `report` | `report` `omit` | spec; isg; gw | functional |
| `compression-rate-invalid` | `gw-10QM4WE` | Detect a compression rate (COMRAT) that is malformed when present | `report` | `report` `omit` | spec; isg; gw | functional |
| `decompressed-size-excessive` | `gw-3KX9WQ2` | Detect a zlib-compressed image declaring or expanding to more pixel data than the safe limit | `reject` | `report` `omit` | spec; gw | functional |
| `mask-table-structure-invalid` | `gw-FGA40PE` | Detect an image mask table header field outside the values the spec permits it | `reject` | `report` `omit` | spec; isg; gw | functional |
| `mask-table-unaccounted-bytes` | `gw-ACMSSTN` | Detect an image mask table declaring image data beyond the fields that describe it | `remove` | `remove` `report` `omit` | spec; isg; gw | structural |
| `pixel-data-surplus` | `gw-AWEP9PN` | Detect an uncompressed image segment carrying more data than its declared pixel array holds | `replace` | `replace` `report` `omit` | spec; isg; gw | structural |
| `uncompressed-data-length-invalid` | `gw-797K7EK` | Detect uncompressed (NC/NM) image data shorter than its stored blocks can occupy | `reject` | `report` `omit` | spec; isg; gw | functional |

### `image-dimensions`

Extreme NROWS or NCOLS values can cause integer overflow in dimension\*band\*bitdepth calculations, leading to heap buffer overflow or excessive memory allocation (DoS). NROWS=0 or NCOLS=0 can cause division-by-zero in stride calculations.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `image-cols-out-of-range` | `gw-KM2D0K2` | Detect a number of image columns (NCOLS) below 1 or above the configured maximum (default 65535) | `reject` | `report` `omit` | spec; isg; gw | functional |
| `image-rows-out-of-range` | `gw-40ESGTZ` | Detect a number of image rows (NROWS) below 1 or above the configured maximum (default 65535) | `reject` | `report` `omit` | spec; isg; gw | functional |

### `image-filter-condition`

IFC values other than 'N' indicate filtered image data. Parsers that do not support the declared filter will misinterpret the image data, potentially causing incorrect rendering or buffer errors. IMFLT carries filter parameters that could be weaponized if non-standard.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `image-filter-condition-invalid` | `gw-YMQBZJ2` | Detect an image filter condition (IFC) other than 'N' (no filtering applied) | `report` | `report` `omit` | spec; isg; gw | functional |
| `image-filter-invalid` | `gw-QV0EAKJ` | Detect an image filter (IMFLT) other than spaces when the image filter condition (IFC) is 'N' | `report` | `report` `omit` | spec; isg; gw | functional |

### `image-location-magnification`

An attacker could place an unattached image at a non-zero ILOC offset where standard viewers would not display it, hiding content outside the visible CCS origin.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `image-location-invalid` | `gw-5YXKN8G` | Detect an unattached image placed away from the CCS origin, or an attached image extending beyond its parent segment's bounds (off-canvas data-hiding risk) | `replace` | `replace` `report` `omit` | spec; isg; gw | functional |
| `image-magnification-non-default` | `gw-6YNK7GV` | Detect an image magnification (IMAG) other than the default 1.0 | `replace` | `replace` `report` `omit` | spec; isg; gw | functional |

### `image-mode`

Invalid IMODE values or IMODE/IC mismatches may indicate a manipulated file designed to confuse image rendering or exploit codec-specific behavior.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `image-mode-compression-mismatch` | `gw-C2GACCA` | Detect an image mode (IMODE) inconsistent with the compression code (IC) | `reject` | `report` `omit` | spec; isg; gw | functional |
| `image-mode-invalid` | `gw-1GRMF8Z` | Detect an image mode (IMODE) that is not a permitted value | `reject` | `report` `omit` | spec; isg; gw | functional |

### `image-segment`

Image subheader fields may contain forged or hidden data. IM must be 'IM', IDATIM must be valid and TGTID must contain valid identifiers. TGTID, IID1 and IID2 may disclose sensitive targeting or identification information.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `image-datetime-cross-segment-invalid` | `gw-Y44FCVQ` | Detect an image date/time (IDATIM) later than the file date/time (FDT) | `report` | `report` `omit` | spec; isg; gw | functional |
| `image-datetime-invalid` | `gw-W6N587P` | Detect an image date/time (IDATIM) that is not a valid CCYYMMDDhhmmss datetime | `report` | `report` `omit` | spec; isg; gw | functional |
| `image-id-disclosure` | `gw-EX0KMNE` | Detect target identifier (TGTID) and image identifiers (IID1, IID2) free-text content that may carry sensitive information | `report` | `report` `omit` | spec; isg; gw | functional |
| `image-partition-invalid` | `gw-2WVT86N` | Detect an image subheader file part type (IM) other than 'IM' | `report` | `report` `omit` | spec; isg; gw | functional |
| `image-subheader-length-mismatch` | `gw-JQDKW2V` | Detect an image subheader whose fields do not fit the declared length (LISH) | `reject` | — | spec; isg; gw | functional |
| `image-subheader-unaccounted-bytes` | `gw-B75TX7B` | Detect bytes inside an image subheader that no declared field accounts for | `report` | `report` `remove` `omit` | spec; isg; gw | structural |
| `target-id-invalid` | `gw-NWNFZ76` | Detect a target identifier (TGTID) with an invalid target identifier or country code | `report` | `report` `omit` | spec; isg; gw | functional |

### `image-source-size-location`

Invalid pixel type, representation or category values may indicate a manipulated or non-compliant image subheader. ISORCE and IGEOLO may disclose sensor identity or geographic targeting information.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `actual-bit-depth-invalid` | `gw-KA2W92Q` | Detect actual bits per pixel (ABPP) inconsistent with the actual image data bit depth | `reject` | `report` `omit` | spec; isg; gw | functional |
| `bit-depth-invalid` | `gw-7K9Z0ZD` | Detect a number of bits per pixel (NBPP) inconsistent with the actual image data bit depth and compression | `reject` | `report` `omit` | spec; isg; gw | functional |
| `geographic-coordinates-invalid` | `gw-VXQRRV1` | Detect a geographic location (IGEOLO) that contradicts the coordinate system ICORDS declares | `reject` | `report` `omit` | spec; isg; gw | functional |
| `image-category-invalid` | `gw-1YMK6RN` | Detect an image category (ICAT) that is not a permitted Table A-3 value | `reject` | `report` `omit` | spec; isg; gw | functional |
| `image-representation-invalid` | `gw-T1VE0Y1` | Detect an image representation (IREP) that is not a permitted value | `report` | `report` `omit` | spec; isg; gw | functional |
| `image-source-location-disclosure` | `gw-W8NHN03` | Detect image source (ISORCE) and geographic location (IGEOLO) free-text content that may carry sensitive information | `report` | `report` `omit` | spec; isg; gw | functional |
| `pixel-justification-invalid` | `gw-BVD1FYD` | Detect a pixel justification (PJUST) that is not a permitted value | `report` | `report` `omit` | spec; isg; gw | functional |
| `pixel-type-invalid` | `gw-SPFHVNE` | Detect a pixel value type (PVTYPE) that is not a permitted value | `reject` | `report` `omit` | spec; isg; gw | functional |

### `image-sync`

ISYNC is a reserved field that must always be 0. A non-zero value may indicate data hiding in the reserved field or a corrupted/manipulated file structure.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `image-sync-invalid` | `gw-QCA9R7Q` | Detect a reserved image sync field (ISYNC) other than 0 | `replace` | `replace` `report` `omit` | spec; isg; gw | functional |

### `metadata-text`

Metadata text is operator-authored and rendered by downstream consumers, so a script literal or injection sequence hidden there runs where the imagery is displayed. Canonicalization defeats a cloak that splits the literal with an invisible code point.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `metadata-injection-sequence` | `gw-828D9X3` | Detect a template, expression or SQL injection metacharacter sequence in metadata text | `report` | `report` `omit` | cve; gw | functional |
| `text-active-content-present` | `gw-VE1TPVM` | Detect active or executable content in text data or subheader free text | `reject` | `report` `omit` | spec; isg; gw | functional |
| `text-zero-width-character-present` | `gw-Z2EB4B2` | Detect an invisible or zero-width Unicode code point in text or subheader free text | `report` | `report` `omit` | gw; analogy | functional |

### `originator-information`

The Originator's Name and Phone Number fields may contain values that do not match an approved whitelist or expected pattern, potentially indicating data hiding or substitution.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `originator-name-disclosure` | `gw-NA9EM24` | Detect originator name (ONAME) free-text content that may carry sensitive information | `replace` | `replace` `report` `omit` | spec; isg; gw | functional |
| `originator-phone-disclosure` | `gw-C2RBSSP` | Detect originator phone (OPHONE) free-text content that may carry sensitive information | `replace` | `replace` `report` `omit` | spec; isg; gw | functional |

### `overflow-des`

Overflow DES segments must have valid DESID='TRE_OVERFLOW' and DESOFLW pointing to a valid overflow source. Overflow DES data contains TRE content that may disclose sensitive information.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `overflow-des-data-disclosure` | `gw-H41BH5J` | Detect overflow DES TRE free-text content that may carry sensitive information | `report` | `report` `omit` | spec; isg; gw | functional |
| `overflow-des-id-invalid` | `gw-FS84P3G` | Detect an overflow DES identifier (DESID) other than 'TRE_OVERFLOW' | `report` | `report` `omit` | spec; isg; gw | functional |
| `overflow-des-target-invalid` | `gw-K9RCTBC` | Detect an overflow DES source identifier (DESOFLW) that is invalid | `report` | `report` `omit` | spec; isg; gw | functional |
| `overflow-des-type-invalid` | `gw-1RPYRFN` | Detect an overflow DES subheader file part type (DE) other than 'DE' | `report` | `report` `omit` | spec; isg; gw | functional |

### `polyglot-signature`

A file that is simultaneously valid NITF and a valid second format (DICOM at offset 128, UEFI GPT at 512, ISO 9660 at 32769) is a parser-differential vector: a downstream tool that sniffs the second format processes attacker-chosen content the NITF pipeline never inspected.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `polyglot-signature-present` | `gw-NY8D1MT` | Detect a foreign container signature at a fixed file offset that overlays the NITF structure | `report` | `report` `omit` | gw | functional |

### `segment-data`

Segment data may contain hidden or malicious content that requires content review outside the format-specific remediator. An uncompressed pixel array is preserved byte for byte, so a foreign file signature placed at its start is delivered unless it is detected there. Unknown segment types that do not match the expected file part type (IM, SY, TE, DE, RE) must be rejected.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `pixel-data-embedded-file` | `gw-162J4ZM` | Detect an embedded file signature at the start of uncompressed image pixel data | `replace` | `replace` `report` `omit` | spec; isg; gw | visual |
| `pixel-data-embedded-markup` | `gw-7FWQEKM` | Detect an embedded XML or HTML signature at the start of uncompressed image pixel data | `replace` | `replace` `report` `omit` | isg; gw | visual |
| `segment-data-embedded-file` | `gw-ZMNWKTC` | Detect an embedded file signature at the start of graphic or text segment data | `report` | `report` `replace` `omit` | spec; isg; gw | visual |
| `segment-data-embedded-markup` | `gw-H6W4X6C` | Detect an embedded XML or HTML signature at the start of graphic or text segment data | `report` | `report` `replace` `omit` | isg; gw | visual |
| `segment-data-opaque-payload` | `gw-GG0HWSN` | Detect non-image segment payloads (TE, DE, RE) that may carry hidden data or sensitive content | `report` | `report` `omit` | isg; gw | functional |
| `unknown-segment-type` | `gw-G42ARYV` | Detect segments with unknown file part types | `reject` | `report` `omit` | spec; isg; gw | functional |

### `segment-display-level`

Display and attachment levels define how image, graphic and text segments are layered when the file is rendered. A duplicate, dangling or cyclic reference can hide a segment behind another, place it where a viewer never draws it or stall a viewer that follows the chain.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `attachment-level-cyclic` | `gw-9F8HQBE` | Detect a cycle in the display/attachment-level graph (a segment chain that attaches back onto itself) | `reject` | `report` `omit` | spec; isg; gw | functional |
| `attachment-level-invalid` | `gw-4VQ31EH` | Detect a non-zero attachment level (IALVL, SALVL, TXTALVL) that does not reference a valid display level (IDLVL or SDLVL) | `replace` | `replace` `report` `omit` | spec; isg; gw | functional |
| `display-level-not-unique` | `gw-D2GJW1A` | Detect duplicate display levels (IDLVL, SDLVL) across the file | `replace` | `replace` `report` `omit` | spec; isg; gw | functional |

### `segment-information`

The segment information table defines the structure of the entire NITF file. Manipulated segment counts or lengths can hide data, cause buffer overflows or trick parsers into reading incorrect regions. Validating these values is critical for file integrity.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `des-count-out-of-range` | `gw-P6MXYZH` | Detect a number of DES segments (NUMDES) outside the range 0-999 | `reject` | `report` `omit` | spec; isg; gw | functional |
| `graphic-segment-count-out-of-range` | `gw-H2Z4P6B` | Detect a number of graphic segments (NUMS) outside the range 0-999 | `reject` | `report` `omit` | spec; isg; gw | functional |
| `image-segment-count-out-of-range` | `gw-VVM4X5M` | Detect a number of image segments (NUMI) outside the range 0-999 | `reject` | `report` `omit` | spec; isg; gw | functional |
| `label-segment-count-out-of-range` | `gw-PJ18YHJ` | Detect a reserved segment count (NUMX) that is not 0 | `reject` | `report` `replace` `omit` | spec; isg; gw | functional |
| `res-count-out-of-range` | `gw-ZB2NZSH` | Detect a number of RES segments (NUMRES) outside the range 0-999 | `reject` | `report` `omit` | spec; isg; gw | functional |
| `res-count-unsupported` | `gw-3PRW7T5` | Detect NUMRES not equal to 000—Reserved Extension Segments are precluded per JBP 2024.1 | `reject` | `report` `omit` | spec; isg; gw | functional |
| `segment-alignment-invalid` | `gw-QVD8RQ8` | Detect a segment whose subheader + data length does not align with the next segment start | `reject` | `report` `omit` | spec; isg; gw | functional |
| `segment-length-out-of-range` | `gw-7RA51QB` | Detect segment subheader or data lengths outside the allowed ranges | `reject` | `report` `omit` | spec; isg; gw | functional |
| `segment-location-invalid` | `gw-KV5CQ80` | Detect a segment that does not exist at the correct file offset with the expected file part type | `reject` | `report` `omit` | spec; isg; gw | functional |
| `segment-pair-count-invalid` | `gw-924XPR7` | Detect segment length pair counts that do not match the declared segment counts | `reject` | `report` `omit` | spec; isg; gw | functional |
| `segment-table-unreconciled` | `gw-4CMRV84` | Detect a segment length table that does not reconcile with the declared file length (FL) | `reject` | `report` `omit` | spec; isg; gw | functional |
| `text-segment-count-out-of-range` | `gw-CYYH9HB` | Detect a number of text segments (NUMT) outside the range 0-999 | `reject` | `report` `omit` | spec; isg; gw | functional |

### `tagged-record-extension-fields`

A value crafted inside an allowlisted TRE (out-of-range coefficient, NaN, non-enumerated code or an encoding-armored / injected byte) can ride through the structural TRE checks. Per-field schema validation of the high-value cataloged TREs detects poisoned values and neutralizes them in place where a safe default exists.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `geolob-field-values` | `gw-DNASAXB` | Detect an out-of-range or malformed geo coordinate value inside a GEOLOB TRE | `report` | `report` | spec; gw | functional |
| `geopsb-field-values` | `gw-1JS23K1` | Detect a non-enumerated coordinate-system value inside a GEOPSB TRE | `replace` | `replace` `report` | spec; gw | functional |
| `geopsb-text-charset` | `gw-D2PKCX5` | Detect a non-printable or injected byte inside a GEOPSB text TRE | `replace` | `replace` `report` | spec; gw | functional |
| `histoa-field-values` | `gw-3C7X2M9` | Detect an out-of-range numeric field value inside a HISTOA TRE | `replace` | `replace` `report` | spec; gw | functional |
| `histoa-text-charset` | `gw-ECXMYRE` | Detect a non-printable or injected byte inside a HISTOA text TRE | `replace` | `replace` `report` | spec; gw | functional |
| `ichipb-field-values` | `gw-1HFN5GM` | Detect an out-of-range, NaN or non-enumerated field value inside an ICHIPB TRE | `replace` | `replace` `report` | spec; gw | functional |
| `piaimc-field-values` | `gw-63D4KT0` | Detect an out-of-range numeric field value inside a PIAIMC TRE | `replace` | `replace` `report` | spec; gw | functional |
| `piaimc-text-charset` | `gw-JFJZNXY` | Detect a non-printable or injected byte inside a PIAIMC text TRE | `replace` | `replace` `report` | spec; gw | functional |
| `pixmta-text-charset` | `gw-1T9MJH6` | Detect a non-printable or injected byte inside a PIXMTA text TRE | `replace` | `replace` `report` | spec; gw | functional |

### `tagged-record-extensions`

TRE tags must be printable BCS-A, lengths must be accurate and data must be within bounds across all TRE locations. TRE data may contain sensitive information not visible in standard metadata.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `character-run-excessive` | `gw-2HB5DQB` | Detect a run of one repeated character long enough to stall a backtracking pattern | `report` | `report` `omit` | spec; isg; gw | structural |
| `tre-aggregate-size-anomalous` | `gw-FBMY2H5` | Detect total TRE data occupying an anomalous proportion of the file size | `report` | `report` `omit` | spec; isg; gw | functional |
| `tre-data-disclosure` | `gw-KMVWYCC` | Detect TRE free-text data that may carry sensitive information | `report` | `report` `omit` | spec; isg; gw | functional |
| `tre-data-embedded-file` | `gw-8BKEYSV` | Detect TRE data carrying an embedded file signature other than markup | `reject` | `report` `omit` | spec; isg; gw | functional |
| `tre-data-embedded-markup` | `gw-PF1DTAR` | Detect TRE data carrying an embedded XML or HTML signature | `report` | `report` `omit` | isg; gw | functional |
| `tre-data-entropy-suspicious` | `gw-0W2B11Q` | Detect TRE data with anomalously high entropy indicating hidden or encrypted content | `report` | `report` `omit` | spec; isg; gw | functional |
| `tre-data-null-padding` | `gw-T640VA3` | Detect TRE data carrying null padding that may conceal hidden content | `report` | `report` `omit` | spec; isg; gw | functional |
| `tre-data-printable-ratio-suspicious` | `gw-C8MGAZK` | Detect TRE data with an anomalous printable-character ratio | `report` | `report` `omit` | spec; isg; gw | functional |
| `tre-length-inaccurate` | `gw-5DAB279` | Detect a TRE length (TREL) that is not a valid 5-digit length or whose data is not accessible | `reject` | `report` `omit` | spec; isg; gw | functional |
| `tre-overflow-chain-invalid` | `gw-C4B0HH3` | Detect TRE_OVERFLOW DES segments whose TREs do not match their declared source | `reject` | `report` `omit` | spec; isg; gw | functional |
| `tre-overflow-incoherent` | `gw-8GF24AD` | Detect TRE_OVERFLOW DES DESOFLW/DESITEM that do not match the source segment overflow pointers | `reject` | `report` `omit` | spec; isg; gw | functional |
| `tre-phantom-present` | `gw-AABN1H8` | Detect phantom TRE areas not accounted for by declared TRE lengths | `reject` | `report` `omit` | spec; isg; gw | functional |
| `tre-size-anomalous` | `gw-E75FJ68` | Detect a TRE length (TREL) that is anomalously large for its tag | `report` | `report` `omit` | spec; isg; gw | functional |
| `tre-tag-collision-set` | `gw-8PECSVH` | Detect extension tags chosen to share a hash value, degrading a consumer's lookup | `report` | `report` `omit` | spec; isg; gw | structural |
| `tre-tag-duplicate` | `gw-5QJC8TS` | Detect duplicate TRE tags within a segment | `reject` | `report` `omit` | spec; isg; gw | functional |
| `tre-tag-format-invalid` | `gw-ZQ4GZYE` | Detect a TRE tag (TRETAG) that is not 6 BCS-A printable characters in any TRE location | `reject` | `report` `omit` | spec; isg; gw | functional |
| `tre-tag-not-allowlisted` | `gw-XM5SE2Z` | Detect TRE tags outside the allowlist of known-good CETAG values | `report` | `report` `omit` | spec; isg; gw | functional |
| `tre-tag-unregistered` | `gw-77WEJXH` | Detect TREs whose CETAG values are not in the known-good catalog (STDI-0002, STDI-0006, NGA.STND.0044, MIL-PRF-89034, NSGPDD, BPJ2K01) | `report` | `report` `omit` | spec; isg; gw | functional |

### `text-extended-data`

TXSHDL defines the size of extended subheader data in text segments. Values of 1 or 2 are invalid (must be 0 or 3-99999). Manipulated lengths can cause parsers to read incorrect data. TXSHD TRE data may contain sensitive information that requires external filtering.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `text-ext-header-disclosure` | `gw-2QMW37E` | Detect text extended-subheader (TXSHD) TRE free-text content that may carry sensitive information | `report` | `report` `omit` | spec; isg; gw | functional |
| `text-ext-header-length-invalid` | `gw-PEJB863` | Detect a text extended-subheader data length (TXSHDL) that is invalid | `reject` | `report` `omit` | spec; isg; gw | functional |

### `text-format`

Invalid text format or mismatched character encoding may hide data or enable attacks.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `text-data-charset-invalid` | `gw-5HHFX05` | Detect malformed, control or non-text bytes in TXTDATA inconsistent with the declared TXTFMT charset | `reject` | `report` `omit` | spec; isg; gw | functional |
| `text-data-charset-superset` | `gw-CHS7PB2` | Detect well-formed characters in TXTDATA outside the declared TXTFMT charset (e.g. UTF-8 text in a BCS/ECS segment) | `report` | `report` `omit` | spec; isg; gw | functional |
| `text-format-invalid` | `gw-91ADGNH` | Detect a text format (TXTFMT) other than the allowed values MTF, STA, UT1 or U8S | `reject` | `report` `omit` | spec; isg; gw | functional |

### `text-subheader`

Text subheader fields may contain forged or hidden data. TE must be 'TE', TXTDT must be a valid datetime not after FDT. TXTITL may disclose sensitive identification information.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `text-datetime-cross-segment-invalid` | `gw-9RV3DZ6` | Detect a text date/time (TXTDT) later than the file date/time (FDT) | `report` | `report` `omit` | spec; isg; gw | functional |
| `text-datetime-invalid` | `gw-DKSFKAR` | Detect a text date/time (TXTDT) that is not a valid CCYYMMDDhhmmss datetime or all hyphens | `replace` | `replace` `report` `omit` | spec; isg; gw | functional |
| `text-id-non-default` | `gw-0BH7NP0` | Detect a text segment identifier (TEXTID) carrying a non-default or potentially sensitive value | `replace` | `replace` `report` `omit` | isg; gw | visual |
| `text-partition-invalid` | `gw-30Q5AB1` | Detect a text subheader file part type (TE) other than 'TE' | `report` | `report` `omit` | spec; isg; gw | functional |
| `text-title-disclosure` | `gw-R71BZDJ` | Detect a text segment title (TXTITL) that may carry sensitive free text | `replace` | `replace` `report` `omit` | isg; gw | visual |
| `text-title-free-text-disclosure` | `gw-ADBEXYT` | Detect text segment title (TXTITL) free-text content that may carry sensitive information | `report` | `report` `omit` | spec; isg; gw | functional |

### `user-defined-header`

The User Defined Header Data fields (UDHDL, UDHOFL, UDHD) allow TRE data in the file header. Invalid length values or overflow references to non-existent DES segments can hide data or cause incorrect parsing. User Defined Header Data (UDHD) may contain TRE data with sensitive or classified information that requires external filtering before release.

| Rule | ID | Detects | Default | Configurable actions | Compliance | Impact |
|---|---|---|---|---|---|---|
| `user-header-length-out-of-range` | `gw-NQGGPB0` | Detect a user-defined header data length (UDHDL) that is neither 0 nor within 3-99999 | `report` | `report` `omit` | spec; isg; gw | functional |
| `user-header-overflow-invalid` | `gw-2JWSKX0` | Detect a user-defined header overflow reference (UDHOFL) that does not reference a valid DES segment | `report` | `report` `omit` | spec; isg; gw | functional |
| `user-header-present` | `gw-KD9JWG8` | Detect user-defined header (UDHD) TRE data that may carry sensitive information | `report` | `report` `omit` | isg; gw | functional |

## Related pages

- [Define content management policies](/rest-api/define-content-management-policies)
- [NITF and NSIF embedded content rules](/halo/nitf-nsif-embedded-content-rules)
- [Policy management API](/rest-api/about-policy-management-api)
- [Supported file types](/halo/glasswall-halo-supported-file-types)
- [Archive support](/halo/glasswall-halo-archive-support)