topic Re: Custom data pattern in General Topics

Custom data pattern

jdprovine — Mon, 28 Mar 2016 19:00:35 GMT

How do you create a working custom data pattern file?

Re: Custom data pattern

kiwi — Tue, 29 Mar 2016 07:03:29 GMT

Here's one example :

RegEx-Pattern-for-Danish-SSN-in-Data-Filtering-Profile

Hope it helps,

-Kim.

Re: Custom data pattern

jdprovine — Tue, 29 Mar 2016 13:03:32 GMT

Thanks I already found that one, it didn't help

Re: Custom data pattern

Brandon_Wertz — Tue, 29 Mar 2016 13:28:53 GMT

Maybe if you provide what you're actually trying to match on?

Re: Custom data pattern

jdprovine — Tue, 29 Mar 2016 13:58:54 GMT

It's a customer pattern - testregex weight 1, alert threshold 1, block threshold 0

Re: Custom data pattern

jdprovine — Tue, 29 Mar 2016 19:11:14 GMT

Does it have to be credit card and SS info? Does it have to be in a document? Can it be just a word for it to look for?

Re: Custom data pattern

kiwi — Wed, 30 Mar 2016 07:09:39 GMT

Hi,

No it does not have to be CC or SSN info.

The admin guide provides another example where it matches on custom pattern 'confidential' :

set-up-data-filtering

In the profile you can select the file type. By selecting 'any' it will NOT block all possible file types ... just the ones listed :

File Types

Specify the file types to include in the filtering rule:

•	Choose any to apply the filter to all of the listed file types. This selection does not block all possible file types, just the listed ones.

•	Click Add to specify individual file types.

Cheers,

-Kim.

Re: Custom data pattern

jdprovine — Wed, 30 Mar 2016 12:58:59 GMT

I believe I have it all set up as recommended in the article and its still not working. It even shows the rule as being hit but not showing up in in the data filtering logs or the traffic logs

Re: Custom data pattern

santonic — Fri, 01 Apr 2016 06:03:18 GMT

What protocol? Is the session encrypted maybe?

Re: Custom data pattern

jdprovine — Fri, 01 Apr 2016 12:47:50 GMT

I have it set for any service, any application and to filter on the word testregex and regextest. My boss wanted me to see if it would key on this url http://servername/testregex and it does not. But the rule that I created and applied the filter is seeing ssh traffic when I connect to the server. My first thought is that I need to upload some kind of file that I cannot use a url. Anyone currently doing data filtering if you can let me know how you are testing that would be helpful. TAC has also tested the data pattern I created and they said it worked.

Re: Custom data pattern

reaper — Fri, 01 Apr 2016 13:04:17 GMT

imho that should work

a bit weird you're seeing ssh as that is a completely different protocol

have you set up a server to actually respond to your request ? you will need to have a live server set up so you're able to reach the stage where the string is passed: you first need to have the 3 way handshake establish a connection before the client requests the url/path

C S

SYN ->

<-SYN/ACK

ACK->

GET servername/testregex->

<-webpage

Re: Custom data pattern

jdprovine — Fri, 01 Apr 2016 13:50:39 GMT

Reaper old buddy, I am seeing the ssh traffic on the rule I created with the data filtering profile on it Yes trying it with a live server using a url with the regex in it to that live server and its not alerting on the rule. But it is returning a page cannot be found. I was thinking maybe the data filtering portion wasn't working because I was using a url not a file with the text in the bocy

Re: Custom data pattern

jdprovine — Fri, 01 Apr 2016 16:35:54 GMT

Has to be a document upload not a url and in some cases dycryption has to be used