<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Custom data pattern in Custom Signatures</title>
    <link>https://live.paloaltonetworks.com/t5/custom-signatures/custom-data-pattern/m-p/156667#M173</link>
    <description>&lt;P&gt;Hi Claude&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Thanks for the reply, any idea how we can get the pattern working then , any input will be highly appreciated&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Regards&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Amogh&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Mon, 15 May 2017 15:02:00 GMT</pubDate>
    <dc:creator>agawade</dc:creator>
    <dc:date>2017-05-15T15:02:00Z</dc:date>
    <item>
      <title>Custom data pattern</title>
      <link>https://live.paloaltonetworks.com/t5/custom-signatures/custom-data-pattern/m-p/155794#M171</link>
      <description>&lt;P&gt;Hi Team&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;I have a user who has a requirement to add a custom Data Pattern to identify a specific string&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Example: 1234/0&lt;STRONG&gt;9&lt;/STRONG&gt;/4578&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;EM&gt;&lt;STRONG&gt;(Note the second identifier is a numeric value between [1-9])&lt;/STRONG&gt;&lt;/EM&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;I set up the data pattern under " Custom Objects ---&amp;gt;Data Pattern ---&amp;gt; Add " in the following format to achieve this &amp;nbsp;"(/d/d/d/d)/-(/d[1-9])/-(/d/d/d/d)" , but this fails with the following error messge&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;test123 -&amp;gt; pattern -&amp;gt; numbers -&amp;gt; regex '(/d/d/d/d)/-(/d[1-9])/-(/d/d/d/d)' is invalid. can't handle two dfas next to each other in pattern '(/d/d/d/d)/-(/d[1-9])/-(/d/d/d/d)'&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;test123 -&amp;gt; pattern -&amp;gt; numbers -&amp;gt; regex is invalid&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;But it works without any issues when we put it as &amp;nbsp;"&lt;/SPAN&gt;(/d/d/d/d)/-(/d/d)/-(/d/d/d/d)"&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Is this an expected behavior?&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Regards&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Amogh Gawade&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Tue, 09 May 2017 19:43:20 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/custom-signatures/custom-data-pattern/m-p/155794#M171</guid>
      <dc:creator>agawade</dc:creator>
      <dc:date>2017-05-09T19:43:20Z</dc:date>
    </item>
    <item>
      <title>Re: Custom data pattern</title>
      <link>https://live.paloaltonetworks.com/t5/custom-signatures/custom-data-pattern/m-p/156508#M172</link>
      <description>&lt;P&gt;Hi Amogh,&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;I would say this is anticipated behavior.&amp;nbsp; You can not have two strings less than 7 bytes seperated by a wildcard element.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;-Claude&lt;/P&gt;</description>
      <pubDate>Sat, 13 May 2017 01:01:53 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/custom-signatures/custom-data-pattern/m-p/156508#M172</guid>
      <dc:creator>claudec</dc:creator>
      <dc:date>2017-05-13T01:01:53Z</dc:date>
    </item>
    <item>
      <title>Re: Custom data pattern</title>
      <link>https://live.paloaltonetworks.com/t5/custom-signatures/custom-data-pattern/m-p/156667#M173</link>
      <description>&lt;P&gt;Hi Claude&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Thanks for the reply, any idea how we can get the pattern working then , any input will be highly appreciated&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Regards&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Amogh&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Mon, 15 May 2017 15:02:00 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/custom-signatures/custom-data-pattern/m-p/156667#M173</guid>
      <dc:creator>agawade</dc:creator>
      <dc:date>2017-05-15T15:02:00Z</dc:date>
    </item>
  </channel>
</rss>

