topic Re: Regular Expression Fail in General Topics

Regular Expression Fail

rroberts — Wed, 21 Dec 2011 23:27:38 GMT

I keep getting the following error "is invalid. pattern must be at least 7 bytes"

Example match: 378282246310005

How I would normally match via regex: .*[3][47][0-9]{13}

How I am interpreting Palo Alto wants me to write it: .*(3)[47].*([0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9])

I have tried at least a dozen variations of regexs, all pass the logic test but the PA appliance keeps giving me the same error. I thought I was going crazy so I had several colleagues verify my logic and they agree it's correct. If it was a syntax error, it would say as much but it is obviously failing the verification of the 7 byte requirement.

What gives and why the limited and inefficient regex support?

Software Version: 4.0.5

//rr

Re: Regular Expression Fail

rmonvon — Thu, 22 Dec 2011 14:54:35 GMT

Our custom signature requires a minimum 7-byte fixed pattern (i.e. 7-bytes anchor) to be specified. To match 378282246310005, we may pick 3782822 as the anchor so the complete pattern may look like 3782822[0-9][0-9][0-9][0-9][0-9][0-9][0-9].

What are you trying to match, credit card numbers?

Re: Regular Expression Fail

rroberts — Thu, 22 Dec 2011 15:22:53 GMT

At least I understand why it is failing now.

The modulus 10 algorithm that PA uses by default seems to produce quite a few false positives and makes it difficult to find meaningful data. I've written regular expressions for all known credit card types to be very specific in order to avoid false positives. This "7-byte anchor" requirement limits the flexibility of the appliances, in some cases there is no possible way to know that much of the data beforehand. Why would Palo Alto Networks only allow a subset of regex constants and operators, and place such stringent requirements on data filtering?

//rr

Re: Regular Expression Fail

rmonvon — Thu, 22 Dec 2011 15:43:10 GMT

We use the modulus 10 algorithm as the method is widely employed by the credit card industry. If you're seeing a fair amount of false positives, may I suggest you open a support case to have it investigated.

I agree the 7-byte anchor does place a limitation on the regex pattern. Factors contributing to this include resource constraints, feature is supported acorss all PA models, & maintaining performance.

Thanks.

Re: Regular Expression Fail

rroberts — Thu, 22 Dec 2011 16:16:27 GMT

Thank you for your assistance rmonvon.

//rr