Capture Gmail Username

[jdessoliers]

Hi,

I am about to finish an evaluation with a customer.

He just shared with me a specfic requirement which would make him choose Palo Alto over competitors :

Gmail must be allowed, but it must be possible to capture the username used to login to gmail.

I have set up Outbound SSL Decryption, however i am struggling with Data Patterns :

Normal regex would be : /@gmail\.com$/i

However, Palo Alto seems to interpret Regex its own way so, according to the Admin Guide, the pattern should be : .*((@gmail.com)|(@Gmail.com)|(@GMAIL.COM))

When I try to save this pattern, I am told "Pattern is invalid. Pattern must be at least 7 bytes".

The "@gmail" keyword seems to be too small, whereas "@hotmail.com" just fits the requirements.

Could anyone give me a workaround ? Can I use another pattern ? Is there another way to get to the same results ?

I guess it must be possible to read the "HTTPS Put" traffic and find a string similar to : ...,username=XXX@gmail.com,... and to create a DLP rule based on this pattern.

Any kind of help would be welcome.

Beforehand, thank you

DESSOLIERS Jean-Manuel

[msullivan]

Hi Jean-Manuel,

Maybe something like [Gg][Mm][Aa][Ii][Ll]\.[Cc][Oo][Mm]

I havent tested it, so you may need to play with it to really work.

Cheers,

Mike