Custom app-id with regex for alphanumeric that limits to 10 characters

[chtoh82]

Am trying to create an app id that identifies a particular  pattern that only be 10 characters long and must be alphanumeric, had tried various syntax but seems not to be accepted as a correct pattern with the message that the expression is not at least 7 bytes. Anyone whom have such experiences can share the the correct expression syntax? Thanks!

The following is what I've tried:

[a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9]

.([a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9])

.([a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9])*

(.([a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9]))

[gwesson]

The system needs 7 bytes that are not regular expression fields. The [a-zA-Z0-9] text is an expression, so it is not valid. You would need something like:

blahbla[a-zA-Z0-9][a-zA-Z0-9]...

From the custom objects (data patterns) page, even though you're creating an app the same requirements apply:

https://www.paloaltonetworks.com/documentation/71/pan-os/web-interface-help/objects/objects-custom-o...:

Syntax for Data Patterns

When adding a new pattern (regular expression), the following general requirements apply:

• The pattern must have string of at least 7 bytes to match. It can contain more than 7 bytes, but not fewer.
• The string match may or may not be case-sensitive, depending on which decoder is being used. When case-sensitivity is required, you would need to define patterns for all of the possible strings in order to match all variations of a term. For example, if you wanted to match any documents designated as confidential, you would need to create a pattern for “confidential”, “Confidential”, and “CONFIDENTIAL”.

[chtoh82]

If i am trying to create a regex that match any 10 alplanumeric characters whenever i see an 7 byte anchor, example:

whenever i sees blablaa, i want to also match the 10 alphanumeric characters following it, how would the regex looks?

had tried the following,

(blablaa).*(.([A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9]).).*

(blablaa).*(.([A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9]).)

(blablaa)([A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9][A-Z0-9])

what i noticed is that it is matching no matter how many alphanumeric characters following it.

[gwesson · Accepted solution]

It looks like you've excluded all of the lower case matches from your groups (your first example had a-zA-Z0-9). The parenthesis are also not needed, since you're not storing the values to capture groups. Try this:

blablaa[a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9]

[chtoh82]

Thanks for the advice, i tried this:

blaabla[a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9]

it matches to any alphanumeric that has 10 chracters and above, however, my use case is to limit it to only 10 characters, can this be done?

[chtoh82]

I think i partially solved it by adding another anchor at the back,

blaabla[a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9][a-zA-Z0-9]blaaa

Thank case, it needs to match exactly to 10 characters, however, not sure if  there is a way to make it into a range of from 1 to 10 characters..

[WPamungkas]

you can use "[\w]{1,10}" to match range from 1 to 10 alphanumeric characters