Regexp case sensitivity

SimasK — Mon, 07 Feb 2011 12:51:38 GMT

I'm trying to create case insensitive regexp for data filtering, however couldn't find any standard regexp way which would work.

Also when I tried to workaround and created following data pattern [Vv][Ii][Dd][Ii][Nn][Ii][Aa][Mn] (which is perfectly valid regexp in my opinion) I received data-object-patter-validation error.

Any suggestions how to do it ?

Re: Regexp case sensitivity

spolo — Tue, 08 Feb 2011 07:09:32 GMT

While it doesn't answer your specific question, the Admin Guide does a fair job of explaining how the regex works in PAN-OS. I've extracted the pages from a section called "About Data Patterns" and attached them here. In short, though, the data patterns are case sensitive, so I think you'd have to use an "or" function for the pattern you're looking for:

An excerpt:

The following are examples of valid custom patterns:

.*((Confidential)|(CONFIDENTIAL))
     – Looks for the word “Confidential” or “CONFIDENTIAL” anywhere
     – “.*” at the beginning specifies to look anywhere in the stream
     – Does not match “confidential” (all lower case)

.*(Press Release).*((Draft)|(DRAFT)|(draft))
– Looks for “Press Release” followed by various forms of the word draft, which may
indicate that the press release isn't ready to be sent outside the company

In looking at the pattern you gave as an example, for one, I think the last letter is incorrect and you'd want it to be [Mm] and not [Mn]. I know, picky picky. Secondly, I think the pattern you want would be:

.*([Vv]).*([Ii]).*([Dd]).*([Ii]).*([Nn]).*([Ii]).*([Aa]).*([Mm])

But if this is all you put in, this triggers an error, since the pattern fails to meet the minimum 7 byte requirement. Don't ask me why, but that's happens when I try it. So my other question is, can you front-end or back-end this with another string to meet the 7 bytes? For example, when I use:

test123.*([Vv]).*([Ii]).*([Dd]).*([Ii]).*([Nn]).*([Ii]).*([Aa]).*([Mm])

the pattern is accepted and I believe it would work.

Outside of this, I think you'd have to just use whatever you thought would be the most common capitalizations.... VIDINIAM, vidiniam, Vidiniam, VidiNiam, etc. and do OR functions around those as shown in the examples above.

Re: Regexp case sensitivity

SimasK — Thu, 10 Feb 2011 09:50:26 GMT

You are right, your answer doesn't answer my question and I only ask when I can't find answer in the manual

topic Re: Regexp case sensitivity in General Topics

Regexp case sensitivity

Re: Regexp case sensitivity

Re: Regexp case sensitivity