Regular expression in Data Pattern

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
Not applicable

Regular expression in Data Pattern

Hi all,

my Palo don't accept this regex when i try to creta a data pattern: [^d][^2][^t]\.xxxxxx\.fr

can anyone correct me if there is any mistake in this regexp

Thanks


Highlighted
L3 Networker

what are you trying to capture in data filtering?

Highlighted
L4 Transporter

Did you get an error like this:

-> pattern -> 3 -> regex '[^d][^2][^t]\.xxxxxx\.fr' is invalid. can't handle two dfas next to each other in pattern '[^d][^2][^t]\.xxxxxx\.fr'

Highlighted
Not applicable

yes exactly i get this error

Highlighted
L4 Transporter

What are you trying to search for? I'm going to guess this is for a custom application.

I think you just need to rework your RegEx.

Highlighted
Not applicable

i have this regex in my old proxy and i am trying to implement it in my Palo Alto to block an URL, as URL filtering in Palo Alto don't support the regex i am trying to implement this in data filtering with data pattern.i hope that you see what i mean.

i found the regex in the old proxy and it worked but in the palo i get error.

Highlighted
L4 Transporter

Can you give an example of that URL you are trying to filter on?

Highlighted
L6 Presenter

Are you trying to match on web domain *.xxxxxx.fr ? 

Highlighted
Not applicable

here is the exact regex, the problem is not in the URL it's on the regex:

[^d][^2][^t]\.terra-octet\.fr

Highlighted
L4 Transporter

Looks like you're trying to block a file sharing website.

Would blocking *.terra-octet.fr in the URL filtering profile not work?

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!