Custom app-id with regex for alphanumeric that limits to 10 characters

L2 Linker

Custom app-id with regex for alphanumeric that limits to 10 characters

Am trying to create an app id that identifies a particular  pattern that only be 10 characters long and must be alphanumeric, had tried various syntax but seems not to be accepted as a correct pattern with the message that the expression is not at least 7 bytes. Anyone whom have such experiences can share the the correct expression syntax? Thanks!

 

The following is what I've tried:

 

[a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9]

.([a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9])

.([a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9])*

(.([a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9]))

L7 Applicator

Re: Custom app-id with regex for alphanumeric that limits to 10 characters

The system needs 7 bytes that are not regular expression fields. The [a-zA-Z0-9] text is an expression, so it is not valid. You would need something like:

 

blahbla[a-zA-Z0-9][a-zA-Z0-9]...

 

 

From the custom objects (data patterns) page, even though you're creating an app the same requirements apply:

https://www.paloaltonetworks.com/documentation/71/pan-os/web-interface-help/objects/objects-custom-o...:

 

Syntax for Data Patterns
 
When adding a new pattern (regular expression), the following general requirements apply:
 
  • The pattern must have string of at least 7 bytes to match. It can contain more than 7 bytes, but not fewer.
  • The string match may or may not be case-sensitive, depending on which decoder is being used. When case-sensitivity is required, you would need to define patterns for all of the possible strings in order to match all variations of a term. For example, if you wanted to match any documents designated as confidential, you would need to create a pattern for “confidential”, “Confidential”, and “CONFIDENTIAL”.
L2 Linker

Re: Custom app-id with regex for alphanumeric that limits to 10 characters

If i am trying to create a regex that match any 10 alplanumeric characters whenever i see an 7 byte anchor, example:

 

whenever i sees blablaa, i want to also match the 10 alphanumeric characters following it, how would the regex looks?

 

had tried the following,

 

(blablaa).*(.([A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9]).).*

(blablaa).*(.([A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9]).)

(blablaa)([A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9])

 

what i noticed is that it is matching no matter how many alphanumeric characters following it.

L7 Applicator

Re: Custom app-id with regex for alphanumeric that limits to 10 characters

It looks like you've excluded all of the lower case matches from your groups (your first example had a-zA-Z0-9). The parenthesis are also not needed, since you're not storing the values to capture groups. Try this:

 

blablaa[a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9]
L2 Linker

Re: Custom app-id with regex for alphanumeric that limits to 10 characters

Thanks for the advice, i tried this:

 

blaabla[a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9]

 

it matches to any alphanumeric that has 10 chracters and above, however, my use case is to limit it to only 10 characters, can this be done?

L2 Linker

Re: Custom app-id with regex for alphanumeric that limits to 10 characters

I think i partially solved it by adding another anchor at the back,

 

blaabla[a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9]blaaa

 

 

Thank case, it needs to match exactly to 10 characters, however, not sure if  there is a way to make it into a range of from 1 to 10 characters..

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!