Enterprise DLP
Configure Regular Expressions
Table of Contents
Expand All
|
Collapse All
Enterprise DLP Docs
-
- About Enterprise DLP
- What’s Supported with Enterprise DLP?
- Data Patterns, Document Types, and Data Profiles
- Enable Role Based Access
- Edit the Cloud Content Settings
- Edit the Enterprise DLP Data Filtering Settings
- Edit the Enterprise DLP Snippet Settings
- Configure Syslog Forwarding for Enterprise DLP Incidents
- Request a New Feature
-
-
- Enable Existing Data Patterns and Filtering Profiles
- Modify a DLP Rule on Strata Cloud Manager
- Create a SaaS Security Policy Recommendation to Leverage Enterprise DLP
- Reduce False Positive Detections
- Data Dictionaries
- Recommendations for Security Policy Rules
- Enterprise DLP Migrator
-
-
-
- Driver License - Australia
- Driver License - Austria
- Driver License - Belgium
- Driver License - Brazil
- Driver License - Bulgaria
- Driver License - Canada
- Driver License - China
- Driver License - Croatia
- Driver License - Cyprus
- Driver License - Czech Republic
- Driver License - Denmark
- Driver License - Estonia
- Driver License - Finland
- Driver License - France
- Driver License - Germany
- Driver License - Greece
- Driver License - Hungary
- Driver License - Iceland
- Driver License - Ireland
- Driver License - Italy
- Driver License - Japan
- Driver License - Latvia
- Driver License - Liechtenstein
- Driver License - Lithuania
- Driver License - Luxembourg
- Driver License - Malta
- Driver License - Netherlands
- Driver License - New Zealand
- Driver License - Norway
- Driver License - Poland
- Driver License - Portugal
- Driver License - Romania
- Driver License - Slovakia
- Driver License - Slovenia
- Driver License - South Africa
- Driver License - South Korea
- Driver License - Spain
- Driver License - Sweden
- Driver License - Switzerland
- Driver License - Taiwan
- Driver License - Turkey
- Driver License - UK
- Driver License - US
- Driver License - US - AK
- Driver License - US - AL
- Driver License - US - AR
- Driver License - US - AZ
- Driver License - US - CA
- Driver License - US - CO
- Driver License - US - CT
- Driver License - US - DC
- Driver License - US - DE
- Driver License - US - FL
- Driver License - US - GA
- Driver License - US - HI
- Driver License - US - IA
- Driver License - US - ID
- Driver License - US - IL
- Driver License - US - IN
- Driver License - US - KS
- Driver License - US - KY
- Driver License - US - LA
- Driver License - US - MA
- Driver License - US - ME
- Driver License - US - MI
- Driver License - US - MN
- Driver License - US - MO
- Driver License - US - MS
- Driver License - US - MT
- Driver License - US - NC
- Driver License - US - ND
- Driver License - US - NE
- Driver License - US - NH
- Driver License - US - NM
- Driver License - US - NV
- Driver License - US - NY
- Driver License - US - OH
- Driver License - US - OK
- Driver License - US - OR
- Driver License - US - PA
- Driver License - US - RI
- Driver License - US - SC
- Driver License - US - SD
- Driver License - US - TN
- Driver License - US - TX
- Driver License - US - UT
- Driver License - US - VA
- Driver License - US - VT
- Driver License - US - WA
- Driver License - US - WI
- Driver License - US - WV
- Driver License - US - WY
- National ID - Albania
- National Id - Argentina ID
- National ID - Australia
- National Id - Austria - Central Register of Residents
- National Id - Austria Social Security Card - e-card
- National ID - Bahrain
- National Id - Belgium - Citizen Service Number - BSN
- National Id - Belgium - National Registration Number
- National ID - Bosnia and Herzegovina
- National ID - Brazil
- National Id - Brazil - CNPJ
- National Id - Brazil - CPF
- National Id - Bulgaria - Uniform Civil Number
- National Id - Canada - Social Insurance Number - SIN
- National ID - Chile
- National Id - China ID
- National Id - Colombia National ID
- National ID - Costa Rica
- National Id - Croatia - Personal Identification Number
- National ID - Cuba
- National Id - Cyprus - Identity Card
- National Id - Czech - Birth Number
- National Id - Czech - National eID Card
- National Id - Denmark - CPR Number
- National ID - Dominican Republic
- National ID - Ecuador
- National ID - Egypt
- National Id - Estonia - Personal Identification Code
- National Id - Finland - Personal Identity Code - HETU
- National Id - France - INSEE
- National Id - France - Social Security Number - NIR
- National Id - Germany
- National Id - Greece
- National Id - Hong Kong ID
- National Id - Hungary - Personal Identification Number
- National Id - Iceland
- National ID - India
- National ID - Indonesia
- National ID - Iran
- National Id - Ireland - Personal Public Service Number - PPSN
- National ID - Israel
- National Id - Italy - Fiscal Code Card - Codice Fiscale
- National Id - Japan Corporate Number
- National Id - Japan My Number
- National ID - Kazakhstan
- National ID - Kuwait
- National Id - Latvia - Personal Public Service Number - PPSN
- National Id - Liechtenstein
- National Id - Lithuania
- National Id - Luxembourg
- National Id - Malaysia National ID
- National Id - Malta
- National ID - Mexico
- National ID - Moldova
- National ID - Montenegro
- National Id - Netherlands - Citizen Service Number - BSN
- National ID - North Macedonia
- National Id - Norway - Identification Number - Fødselsnummer
- National ID - Pakistan
- National ID - Paraguay
- National ID - Peru
- National ID - Philippines
- National Id - Poland
- National Id - Portugal
- National Id - Romania - Identity Card - CNP
- National ID - Russia
- National ID - Serbia
- National Id - Singapore NRIC
- National Id - Slovakia
- National Id - Slovenia
- National ID - South Africa
- National ID - South Korea
- National Id - Spain - National Identity Document - Documento Nacional de Identidad
- National ID - Sri Lanka
- National Id - Sweden - Personal Identity Number
- National ID - Switzerland
- National Id - Taiwan ID
- National Id - Thailand ID
- National Id - Turkey Identification Number
- National Id - UAE Emirates ID
- National Id - UK National Insurance Number - NINO
- National ID - Uruguay
- National Id - US Social Security Number - SSN
- National ID - Venezuela
- Passport - Australia
- Passport - Austria
- Passport - Belgium
- Passport - Brazil
- Passport - Bulgaria
- Passport - Canada
- Passport - Croatia
- Passport - Cyprus
- Passport - Czech Republic
- Passport - Denmark
- Passport - Estonia
- Passport - Finland
- Passport - France
- Passport - Germany
- Passport - Greece
- Passport - Hungary
- Passport - Iceland
- Passport - Ireland
- Passport - Italy
- Passport - Latvia
- Passport - Liechtenstein
- Passport - Lithuania
- Passport - Luxembourg
- Passport - Malta
- Passport - Netherlands
- Passport - New Zealand
- Passport - Norway
- Passport Number - China
- Passport Number - Singapore
- Passport Number - South Africa
- Passport number - South Korea
- Passport number - Taiwan
- Passport - Poland
- Passport - Portugal
- Passport - Romania
- Passport - Slovakia
- Passport - Slovenia
- Passport - Spain
- Passport - Sweden
- Passport - Switzerland
- Passport - Turkey
- Passport - UK
- Passport - US
- Tax Id - Australia
- Tax Id - Austria
- Tax Id - Belgium
- Tax Id - Brazil
- Tax Id - Bulgaria
- Tax ID - Canada
- Tax ID - China
- Tax ID - Costa Rica
- Tax Id - Cyprus
- Tax Id - Czech Republic
- Tax Id - Denmark
- Tax ID - Dominican Republic
- Tax Id - Estonia
- Tax Id - Finland
- Tax Id - France
- Tax Id - Germany
- Tax Id - Greece
- Tax Id - Hungary
- Tax Id - Iceland
- Tax Id - India - PAN
- Tax Id - Ireland
- Tax Id - Italy
- Tax ID - Japan
- Tax Id - Latvia
- Tax Id - Liechtenstein
- Tax Id - Lithuania
- Tax Id - Luxembourg
- Tax Id - Malta
- Tax Id - Netherlands
- Tax Id - New Zealand
- Tax Id - Norway
- Tax Id - Poland
- Tax Id - Portugal
- Tax Id - Romania
- Tax Id - Slovakia
- Tax Id - Slovenia
- Tax ID - South Africa
- Tax ID - South Korea
- Tax Id - Spain
- Tax Id - Sweden
- Tax Id - Switzerland
- Tax ID - Taiwan
- Tax Id - Turkey
- Tax Id - UK - UTR
- Tax Id - US - TIN
-
-
-
-
- March 2025
- February 2025
- January 2025
- December 2024
- November 2024
- October 2024
- September 2024
- August 2024
- July 2024
- June 2024
- April 2024
- March 2024
- January 2024
- December 2023
- November 2023
- October 2023
- August 2023
- July 2023
- June 2023
- May 2023
- March 2023
- February 2023
- January 2023
- November 2022
- October 2022
- August 2022
- July 2022
- June 2022
- May 2022
- April 2022
- March 2022
- February 2022
- January 2022
- December 2021
- November 2021
- October 2021
- September 2021
- July 2021
- New Features in Enterprise DLP Plugin 5.0
- New Features in Enterprise DLP Plugin 4.0
- New Features in Enterprise DLP Plugin 3.0
- New Features in Enterprise DLP Plugin 1.0
-
- Known Issues in the Enterprise DLP Cloud Service
- Known Issues in Endpoint DLP
-
- Known Issues in Enterprise DLP Plugin 5.0.6
- Known Issues in Enterprise DLP Plugin 5.0.5
- Known Issues in Enterprise DLP Plugin 5.0.4
- Known Issues in Enterprise DLP Plugin 5.0.3
- Known Issues in Enterprise DLP Plugin 5.0.2
- Known Issues in Enterprise DLP Plugin 5.0.1
- Known Issues in Enterprise DLP Plugin 5.0.0
-
- Known Issues in Enterprise DLP Plugin 3.0.10
- Known Issues in Enterprise DLP Plugin 3.0.9
- Known Issues in Enterprise DLP Plugin 3.0.8
- Known Issues in Enterprise DLP Plugin 3.0.7
- Known Issues in Enterprise DLP Plugin 3.0.6
- Known Issues in Enterprise DLP Plugin 3.0.5
- Known Issues in Enterprise DLP Plugin 3.0.4
- Known Issues in Enterprise DLP Plugin 3.0.3
- Known Issues in Enterprise DLP Plugin 3.0.2
- Known Issues in Enterprise DLP Plugin 3.0.1
- Known Issues in Enterprise DLP Plugin 3.0.0
-
- Known Issues in Enterprise DLP Plugin 1.0.8
- Known Issues in Enterprise DLP Plugin 1.0.7
- Known Issues in Enterprise DLP Plugin 1.0.6
- Known Issues in Enterprise DLP Plugin 1.0.5
- Known Issues in Enterprise DLP Plugin 1.0.4
- Known Issues in Enterprise DLP Plugin 1.0.3
- Known Issues in Enterprise DLP Plugin 1.0.2
- Known Issues in Enterprise DLP Plugin 1.0.1
- Enterprise DLP Limitations
- Changes to Default Behavior
-
Configure Regular Expressions
Use the Enterprise Data Loss Prevention (E-DLP) regex builder to create expressions that make
content matching easy.
Where Can I Use This? | What Do I Need? |
---|---|
|
Or any of the following licenses that include the Enterprise DLP license
|
The regular expression builder in Enterprise Data Loss Prevention (E-DLP) provides an easy mechanism
to configure regular expressions (regex for short), which you define when you create
a custom data pattern. You can use the regular expression builder to construct a
data pattern expression, view matches, filter occurrences and weight thresholds, and
assess match results to determine if the content poses a risk to your
organization.
There are two types of regular expressions:
- Basic—Searches for a specific text pattern. When Enterprise DLP displays the match occurrences when inspected traffic matches the data pattern match criteria.
- Weighted—Assigns a score to a text entry. When the score threshold is exceeded, such as enough expressions from a pattern match an asset, the service returns a match for the pattern.To reduce false-positives and maximize the search performance of your regular expressions, you can assign scores using the weighted regular expression builder in Enterprise DLP to find and calculate scores for the information that’s important to you. Scoring applies to a match threshold, and when a threshold is exceeded, such as enough words from a pattern are found in a document, the document will be indicated as a match for the pattern.
Use Case: Calculating and Scoring a weighted regular expression
For example, Joe is an employee at a water treatment plant and needs to compile user
data on a proprietary pH additive that is used when source water arrives at the
plant. If Joe initiated a regular expression search with just the term
tap water thousands of match results display, as the
matched tap water documents list the additive. However, Joe is searching for the
first use of the additive and not every document the additive is listed in, making
it difficult for Joe to find the usage data he needs.
To get more accurate results, Joe can initiate a weighted regular expression to
assign weight and occurrence scores to the expression, or indicate the information
to exclude by assigning a negative weight value.
Joe enters a negative weight value to exclude tap water and higher values to source
water and the proprietary water additive. The results are filtered and counted to a
more manageable list, meaning that a document containing 10 occurrences of water
counts as one when all files and folders are scanned. This enables Joe to view the
match results, adjust the totals for weight and occurrences, and calculate an
adjusted score to determine if the content poses a risk to his organization.
Weighted Regex Item
|
Occurrence
|
Adjusted Occurrence Score
|
Adjusted Total
|
---|---|---|---|
Water; 1
|
50
|
50 (1 Occurrence X 1)
|
110 minus 100 for tap water = 10 regex weight
|
IP pH; 2
|
30
|
60 (30 occurrences X 2)
| |
Tap Water; -10
|
10
|
-100 (10 occurrences x -10)
|
- Consider the best practices for using regular expression matches.
- Use predefined data patterns instead of regular expressions. Use Enterprise DLP predefined data patterns instead of regular expressions where possible. Data patterns are more efficient than regular expressions because the predefined data patterns are tuned for accuracy and the data is validated. For example, if you want to search for social security numbers, use the US Social Security Number (SSN) data pattern instead of a regular expression.
- Use regular expressions sparingly. Regular expressions can be computationally expensive. If you add a regular expression condition, observe the system for 1 hour for efficient performance. Make sure that the system does not slow down and there are no false positives.
- Test regular expressions. If you implement regular expression matching, consider using a third-party tool to test the regular expressions before you enable the policy rules. The recommended tool is RegexBuddy. Another good tool for testing your regular expressions is RegExr. If your expression is incorrect, the service can’t match or will match incorrectly.
- Understand expression terminology.Expression Terminology:TermDescriptionLiteralA literal is any character you use in a search or matching expression, for example, to find dlp in Enterprise DLP, dlp is a literal string - each character plays a part in the search, it’s literally the string we want to find.MetacharacterA metacharacter is one or more special characters that have a unique meaning and are not used as literals in the search expression, for example, the character < > (caret) is a metacharacter.Regular ExpressionThis term describes the search expression data pattern that you will be using to search in Enterprise DLP.Escape SequenceAn escape sequence is a way of indicating that you want to use one of the metacharacters as a literal. In a regular expression an escape sequence involves placing the metacharacter \ (backslash) in front of the metacharacter that you use as a literal, for example, if you want to find (dlp) in Enterprise DLP then use the search expression \(dlp\), and if you want to find \\file in the target string c:\\file then you would need to use the search expression \\\\file (each \ to search for a literal (there are 2) that is preceded by an escape sequence \).
- Understand expression constructs.Enterprise DLP implements Perl Compatible Regular Expressions (PCRE) syntax for policy rule condition matching. Enterprise DLP provides some common reference constructs for writing regular expressions to match or exclude characters in content.Regular expression constructs:ConstructDescription.A dot, any single character, except newline (line ending, end of line, or line break) characters.\Escape the next character (the character becomes a normal/literal character.)\dAny digit (0-9.)\sAny white space.\WAny word character (a-z, A-Z, 0-9.)\DAnything other than a digit.\SAnything other than a white space.[ ]Elements inside brackets are a character class (for example, [abc] matches 1 character [a. b. or c.]^At the beginning of a character class, negates it (for example, [^abc] matches anything except (a, b, or c.)$At the end of a character class, or before the newline at the end.+Following a regular expression means 1 or more (for example, \d+ means 1 more digit.)?Following a regular expression means 0 or 1 (for example, \d? means 1 or no digit.)*Following a regular expression means any number (for example \d* means 0, 1, or more digits.)(?i)At the beginning of a regular expression makes it case-insensitive (regular expressions are case-sensitive by default.)( )Groups regular expressions together.(?u)Makes a period ( . ) match to even newline characters.|Means OR (for example, A|B means regular expression A or regular expression B.)
- Understand expression qualifiers.Quantifiers can be used to specify the number or length that part of a pattern should match or repeat. A quantifier will bind to the expression group to its immediate left.Regular expression quantifiers:QuantifierDescription*Match 0 or more times.+Match 1 or more times.?Match 1 or 0 times.{n}Match exactly n times.{n, }Match at least n times.{n, m}Match at least n but not more than m times.
- Enter one regular expression per line, up to 100 lines of expressions.There is no limit to the number of regular expressions you can add to a data pattern. Add as many lines of regular expressions as needed.
- (Weighted expressions only): Assign a regular expression for each line entry between -9999 (lowest importance) to 9999 (highest importance) by entering the regular expression, the delimiter, and the weight score. Enter a weight threshold score of one (1) of more.
- (Optional) Customize your delimiter.By default, the delimiter for all weighted regular expressions is semicolon ( ; ). You can customize your delimiter to copy and paste existing expressions instead of entering them manually. Use a delimiter to specify separate strings of data when configuring regular expressions. For example, you can configure a weighted regular expression using a delimiter to separate the string of text you’re matching from the weight threshold value. If you have large amounts of existing expressions to match, you can customize your delimiter to copy and paste the expressions instead of entering them manually. A delimiter can be any nonalphanumeric, nonbackslash, nonwhitespace character.Regular expression delimiters:DelimiterNote;Semicolon — If the delimiter isn't customized, the semicolon is the default delimiter in Enterprise Data Loss Prevention (E-DLP).:Colon.|Pipe./Forward Slash — You must escape the delimiter using a backlash ( \ ) if the delimiter needs to match inside the data pattern. If the delimiter appears often inside the pattern, it’s a good idea to choose another delimiter to increase readability.+Plus — Include phrase for matching.-Minus — Ignore phrase for matching.#Hash — Used to denote a number.~Tilde{ } CurlyUse brackets to find a range of characters. You don't need to escape bracket-style delimiters when used as meta characters within the pattern, but you must escape bracket-style delimiters when used as literal characters.[ ] Square( ) Parenthesis< > Caret