Configure Regular Expressions

1. Consider the best practices for using regular expression matches.

   • Use predefined data patterns instead of regular expressions. Where possible, use Enterprise DLP predefined data patterns because they are tuned for accuracy and validate the data, which makes them more efficient than regular expressions. For example, if you want to search for Social Security numbers, use the US Social Security Number (SSN) data pattern instead of a regular expression.
   • Use regular expressions sparingly. Regular expressions can be computationally expensive. If you add a regular expression condition, monitor performance for 1 hour. Make sure that performance doesn't degrade and that the condition produces no false positives.
   • Test regular expressions. Before you enable the policy rules, consider using a third-party tool to test your regular expressions. The recommended tool is RegexBuddy. Another tool you can use is RegExr. If an expression is incorrect, Enterprise DLP can't match or matches incorrectly.
2. Understand expression terminology.

   Expression Terminology:

   Term	Description
   Literal	A literal is any character you use in a search or matching expression. For example, to find dlp in Enterprise DLP, dlp is a literal string. Each character plays a part in the search, and the string is exactly what you want to find.
   Metacharacter	A metacharacter is a special character that has a unique meaning and isn't used as a literal in the search expression. For example, the character ^ (caret) is a metacharacter.
   Regular Expression	A search expression data pattern that you use to search in Enterprise DLP.
   Escape Sequence	An escape sequence indicates that you want to use a metacharacter as a literal. In a regular expression, you place the metacharacter \ (backslash) in front of the metacharacter that you use as a literal. For example, to find (dlp) in Enterprise DLP, use the search expression \(dlp\). To find \\file in the target string c:\\file, use the search expression \\\\file. Each \ that you search for as a literal (there are two) must be preceded by the escape sequence \.

3. Understand expression constructs.

   Enterprise DLP performs nondeterministic finite automaton (NFA)-based matching with ordered alternation to inspect forwarded traffic against regex.

   NFA-based matching is a regex-directed detection approach that enables Enterprise DLP to explore multiple detection matches simultaneously. When Enterprise DLP encounters a detection choice such as | or *, it selects one path and records the others using a process called backtracking. This enables Enterprise DLP to return and try alternatives if the initial path fails to match the expression. Palo Alto Networks recommends testing all regex data patterns to ensure efficacy before pushing them to enforcement points in production environments.

   Regular expression constructs:

   Construct	Description
   .	Any single character except newline characters (line ending, end of line, or line break).
   \	Escapes the next character, which becomes a normal (literal) character.
   \b	Any word boundary.
   \d	Any digit (0-9).
   \s	Any whitespace character.
   \W	Any word character (a-z, A-Z, 0-9).
   \D	Anything other than a digit.
   \S	Anything other than a whitespace character.
   [ ]	Elements inside brackets form a character class. For example, [abc] matches one character: a, b, or c.
   ^	At the beginning of a character class, negates it. For example, [^abc] matches any character except a, b, or c.
   $	At the end of a character class, or before the newline at the end.
   +	Following a regular expression means one or more. For example, \d+ means one or more digits.
   ?	Following a regular expression means zero or one. For example, \d? means one digit or no digit.
   *	Following a regular expression means any number. For example, \d* means zero, one, or more digits.
   (?i)	At the beginning of a regular expression, makes it case-insensitive. Regular expressions are case-sensitive by default.
   ( )	Groups regular expressions together.
   (?u)	Makes a period (.) match newline characters.
   |	Means OR. For example, A|B means regular expression A or regular expression B.

4. Understand expression quantifiers.

   Use quantifiers to specify the number or length that part of a pattern must match or repeat. A quantifier binds to the expression group on its immediate left.

   Regular expression quantifiers:

   Quantifier	Description
   *	Match 0 or more times.
   +	Match 1 or more times.
   ?	Match 1 or 0 times.
   {n}	Match exactly n times.
   {n, }	Match at least n times.
   {n, m}	Match at least n but not more than m times.

5. Enter one regular expression per line, up to 100 lines of expressions.

   There is no limit to the number of regular expressions you can add to a data pattern. Add as many lines of regular expressions as needed.

   When you add multiple regular expressions to an unweighted (Basic) data pattern, Enterprise DLP treats each regular expression as an OR condition. A match on any one regular expression is a match for the data pattern. In a weighted data pattern, Enterprise DLP instead adds the weight scores of the matching regular expressions, with negative weights reducing the total, and returns a match for the data pattern when the total exceeds the weight threshold.
6. (Weighted expressions only) For each line entry, enter the regular expression, the delimiter, and a weight score between -9999 (lowest importance) and 9999 (highest importance). Enter a weight threshold score of 1 or more.
7. (Optional) Customize your delimiter.

   By default, the delimiter for weighted regular expressions is a semicolon (;). Use a delimiter to separate strings of data when you configure regular expressions. For example, a delimiter separates the string of text you are matching from the weight score. If you have a large number of existing expressions, you can customize your delimiter to copy and paste the expressions instead of entering them manually. A delimiter can be any nonalphanumeric, nonbackslash, nonwhitespace character.

   Regular expression delimiters:

   Delimiter	Note
   ;	Semicolon. This is the default delimiter in Enterprise DLP if you don't customize it.
   :	Colon.
   |	Pipe.
   /	Forward Slash. If the delimiter must match inside the data pattern, escape it with a backslash (\). If the delimiter appears often inside the pattern, choose another delimiter to improve readability.
   +	Plus. Include the phrase for matching.
   -	Minus. Ignore the phrase for matching.
   #	Hash. Denotes a number.
   ~	Tilde.
   { } Curly	Use brackets to find a range of characters. You don't need to escape bracket-style delimiters when you use them as metacharacters within the pattern, but you must escape bracket-style delimiters when you use them as literal characters.
   [ ] Square
   ( ) Parenthesis
   < > Caret