Focus

PAN-OS Web Interface Reference

Syntax for Regular Expression Data Patterns

Table of Contents

Syntax for Regular Expression Data Patterns

When you create a regular expression data pattern, the following general requirements apply:

The pattern must have a string of at least 7 bytes with fixed values. The 7 bytes cannot contain a period (.), an asterisk (*), a plus sign (+), or a range ([a-z]).
When you require that values be case-sensitive, define patterns for all possible strings to match all variations of a term. For example, to match any documents designated as confidential, you must create a pattern that includes “confidential,” “Confidential,” and “CONFIDENTIAL.”

The regular expression syntax in PAN-OS® is similar to traditional regular expression engines but every engine is unique. The following table describes the syntax supported in PAN-OS.

Pattern Rules Syntax	Description
.	Match any single character.
?	Match the preceding character or expression 0 or 1 time. You must include the general expression inside parentheses. Example: (abc)?
*	Match the preceding character or expression 0 or more times. You must include the general expression inside parentheses. Example: (abc)*
+	Match the preceding character or regular expression one or more times. You must include the general expression inside parentheses. Example: (abc)+
\|	Specify one “or” another. Example: ((bif)\|(scr)\|(exe)) matches “bif,” “scr,” or “exe.” You must include alternative substrings in parentheses.
-	Specify a range. Example: [c-z] matches any character between c and z inclusive.
[ ]	Match any specified character. Example: [abz] matches any of the characters a, b, or z.
^	Match any character except those specified. Example: [^abz] matches any character except a, b, or z.
{ }	Match a string that contains minimum and maximum. Example: {10-20} matches any string that is between 10 and 20 bytes inclusive. You must specify this directly in front of a fixed string and you can use only hyphens (-).
\	Perform a literal match on any character above. You must precede the specified character with a backslash (\).
&amp	The ampersand (&) is a special character so, to look for & in a string, you must use &amp, instead.

Data Pattern Settings

Regular Expression Data Pattern Examples