Regular Expression Fail

cancel
Showing results for 
Search instead for 
Did you mean: 

Regular Expression Fail

Not applicable

I keep getting the following error "is invalid. pattern must be at least 7 bytes"

Example match: 378282246310005

How I would normally match via regex: .*[3][47][0-9]{13}

How I am interpreting Palo Alto wants me to write it: .*(3)[47].*([0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9])

I have tried at least a dozen variations of regexs, all pass the logic test but the PA appliance keeps giving me the same error.  I thought I was going crazy so I had several colleagues verify my logic and they agree it's correct.  If it was a syntax error, it would say as much but it is obviously failing the verification of the 7 byte requirement.

What gives and why the limited and inefficient regex support?

Software Version: 4.0.5

//rr

1 ACCEPTED SOLUTION

Accepted Solutions

L6 Presenter

Our custom signature requires a minimum 7-byte fixed pattern (i.e. 7-bytes anchor) to be specified.  To match 378282246310005, we may pick 3782822 as the anchor so the complete pattern may look like 3782822[0-9][0-9][0-9][0-9][0-9][0-9][0-9].

What are you trying to match, credit card numbers?

View solution in original post

4 REPLIES 4

L6 Presenter

Our custom signature requires a minimum 7-byte fixed pattern (i.e. 7-bytes anchor) to be specified.  To match 378282246310005, we may pick 3782822 as the anchor so the complete pattern may look like 3782822[0-9][0-9][0-9][0-9][0-9][0-9][0-9].

What are you trying to match, credit card numbers?

At least I understand why it is failing now.

The modulus 10 algorithm that PA uses by default seems to produce quite a few false positives and makes it difficult to find meaningful data.  I've written regular expressions for all known credit card types to be very specific in order to avoid false positives. This "7-byte anchor" requirement limits the flexibility of the appliances, in some cases there is no possible way to know that much of the data beforehand.   Why would Palo Alto Networks only allow a subset of regex constants and operators, and place such stringent requirements on data filtering?

//rr

We use the modulus 10 algorithm as the method is widely employed by the credit card industry.  If you're seeing a fair amount of false positives, may I suggest you open a support case to have it investigated.

I agree the 7-byte anchor does place a limitation on the regex pattern.  Factors contributing to this include resource constraints, feature is supported acorss all PA models, & maintaining performance.

Thanks.

Thank you for your assistance rmonvon.

//rr

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!