: Syntax for Regular Expression Data Patterns
Focus
Focus

Syntax for Regular Expression Data Patterns

Table of Contents
End-of-Life (EoL)

Syntax for Regular Expression Data Patterns

When you create a regular expression data pattern, the following general requirements apply:
  • The pattern must have a string of at least 7 bytes with fixed values. The 7 bytes cannot contain a period (.), an asterisk (*), a plus sign (+), or a range ([a-z]).
  • When you require that values be case-sensitive, define patterns for all possible strings to match all variations of a term. For example, to match any documents designated as confidential, you must create a pattern that includes “confidential,” “Confidential,” and “CONFIDENTIAL.”
The regular expression syntax in PAN-OS® is similar to traditional regular expression engines but every engine is unique. The following table describes the syntax supported in PAN-OS.
Pattern Rules Syntax
Description
.
Match any single character.
?
Match the preceding character or expression 0 or 1 time. You must include the general expression inside parentheses.
Example: (abc)?
*
Match the preceding character or expression 0 or more times. You must include the general expression inside parentheses.
Example: (abc)*
+
Match the preceding character or regular expression one or more times. You must include the general expression inside parentheses.
Example: (abc)+
|
Specify one “or” another.
Example: ((bif)|(scr)|(exe)) matches “bif,” “scr,” or “exe.”
You must include alternative substrings in parentheses.
-
Specify a range.
Example: [c-z] matches any character between c and z inclusive.
[ ]
Match any specified character.
Example: [abz] matches any of the characters a, b, or z.
^
Match any character except those specified.
Example: [^abz] matches any character except a, b, or z.
{ }
Match a string that contains minimum and maximum.
Example: {10-20} matches any string that is between 10 and 20 bytes inclusive. You must specify this directly in front of a fixed string and you can use only hyphens (-).
\
Perform a literal match on any character above. You must precede the specified character with a backslash (\).
&amp
The ampersand (&) is a special character so, to look for & in a string, you must use &amp, instead.