Data Filtering Patterns

apackard — Thu, 26 Apr 2012 09:29:13 GMT

Does anyone know the logic used to interpret data patterns/filtering expressions?

By this I mean, if I have two patterns:-

Confidential\\Eyes-Only (exact match Confidential\Eyes-Only)

and

Confidential\\.+ (wildcard match Confidential\*)

Will a file with the string 'Confidential\Eyes-Only' match the former, as the closest match, or the latter as the 'widest' match. There doesn't appear to be a way to order patterns in threat policies, so other than creating dedicated threat policies for each string, and applying them to individual rules, this function seems quite limited.

Also, I have noticed that commit times have increased 5x when working with these type of cutom signatures, does anyone know if this is a sign that my regex logix is 'bad'?

Re: Data Filtering Patterns

sjamaluddin — Tue, 15 May 2012 23:45:20 GMT

With Custom signatures / Data patterns commit times are seen to be longer

The longer more specific match should match first and the wildcard * option should be below the more specific string - like policies and shadowing.

Hope this helps.

topic Re: Data Filtering Patterns in General Topics

Data Filtering Patterns

Re: Data Filtering Patterns