Regular Expression Fail

[rroberts]

I keep getting the following error "is invalid. pattern must be at least 7 bytes"

Example match: 378282246310005

How I would normally match via regex: .*[3][47][0-9]{13}

How I am interpreting Palo Alto wants me to write it: .*(3)[47].*([0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9])

I have tried at least a dozen variations of regexs, all pass the logic test but the PA appliance keeps giving me the same error.  I thought I was going crazy so I had several colleagues verify my logic and they agree it's correct.  If it was a syntax error, it would say as much but it is obviously failing the verification of the 7 byte requirement.

What gives and why the limited and inefficient regex support?

Software Version: 4.0.5

//rr

[rmonvon · Accepted solution]

Our custom signature requires a minimum 7-byte fixed pattern (i.e. 7-bytes anchor) to be specified.  To match 378282246310005, we may pick 3782822 as the anchor so the complete pattern may look like 3782822[0-9][0-9][0-9][0-9][0-9][0-9][0-9].

What are you trying to match, credit card numbers?

[rroberts]

At least I understand why it is failing now.

The modulus 10 algorithm that PA uses by default seems to produce quite a few false positives and makes it difficult to find meaningful data.  I've written regular expressions for all known credit card types to be very specific in order to avoid false positives. This "7-byte anchor" requirement limits the flexibility of the appliances, in some cases there is no possible way to know that much of the data beforehand.   Why would Palo Alto Networks only allow a subset of regex constants and operators, and place such stringent requirements on data filtering?

//rr

[rmonvon]

We use the modulus 10 algorithm as the method is widely employed by the credit card industry.  If you're seeing a fair amount of false positives, may I suggest you open a support case to have it investigated.

I agree the 7-byte anchor does place a limitation on the regex pattern.  Factors contributing to this include resource constraints, feature is supported acorss all PA models, & maintaining performance.

Thanks.

[rroberts]

Thank you for your assistance rmonvon.

//rr