While it doesn't answer your specific question, the Admin Guide does a fair job of explaining how the regex works in PAN-OS. I've extracted the pages from a section called "About Data Patterns" and attached them here. In short, though, the data patterns are case sensitive, so I think you'd have to use an "or" function for the pattern you're looking for: An excerpt: The following are examples of valid custom patterns: .*((Confidential)|(CONFIDENTIAL)) – Looks for the word “Confidential” or “CONFIDENTIAL” anywhere – “.*” at the beginning specifies to look anywhere in the stream – Does not match “confidential” (all lower case) .*(Press Release).*((Draft)|(DRAFT)|(draft)) – Looks for “Press Release” followed by various forms of the word draft, which may indicate that the press release isn't ready to be sent outside the company In looking at the pattern you gave as an example, for one, I think the last letter is incorrect and you'd want it to be [Mm] and not [Mn]. I know, picky picky. Secondly, I think the pattern you want would be: .*([Vv]).*([Ii]).*([Dd]).*([Ii]).*([Nn]).*([Ii]).*([Aa]).*([Mm]) But if this is all you put in, this triggers an error, since the pattern fails to meet the minimum 7 byte requirement. Don't ask me why, but that's happens when I try it. So my other question is, can you front-end or back-end this with another string to meet the 7 bytes? For example, when I use: test123.*([Vv]).*([Ii]).*([Dd]).*([Ii]).*([Nn]).*([Ii]).*([Aa]).*([Mm]) the pattern is accepted and I believe it would work. Outside of this, I think you'd have to just use whatever you thought would be the most common capitalizations.... VIDINIAM, vidiniam, Vidiniam, VidiNiam, etc. and do OR functions around those as shown in the examples above.
... View more