Filtering Service

Transcription

1 Secure Gateway (SEG) Service Administrative Guides Filtering Service Regular Expressions Overview

2 Regular Expressions Overview AT&T Secure Gateway customers can use Regular Expressions to define custom content groups for filtering outbound mail within the SEG service. The feature is meant to be used by customers to help with Data Loss Prevention. With DLP customers can setup rules to help prevent messages with specific terms from being sent out of their environment. NOTE AT&T SEG Technical Support will not provide support to create or debug regular expressions. Regular expressions are an advanced feature that should be undertaken only by those customer administrators that are completely familiar with the creation, use and debugging of such expressions. Parameters The SEG service uses PCRE (Perl-compatible Regular Expressions). Customers are limited to 255 characters per expression (including comments). An error will be displayed if a regex goes beyond the 255 character limit. A regex that takes too long to be processed may be skipped and the service will move on to the next step for processing the message. Message Audit does not show regex information. Definitions Literal A literal is any character used in a search or matching expression Metacharacter One or more special characters that have a unique meaning and are NOT used as literals (for example the ^ ) Search Expression The expression that we are using to search the target string ( ) Escape Sequence A way of indicating that a metacharacter is to be used as a literal. Used for special characters like <CR><LF> or to find directory structures specified in text Syntax

3 [ ] Matches anything inside the square brackets for ONE character position once and only once. For example [12] will look for either a 1 or 2 in that character position [ ] will look for any digit in the range of 0 through 9 - The dash ( - ) when used inside the square brackets acts as a range separator and allows definition of a range for that character position For example [0-9] will look for any digit in the range of 0 through 9 [0-9A-E] will look for either a digit in the range of 0 through 9 OR a capital A through capital E Positional (Anchor) Metacharacters ^ The caret ( ^ ) indicates an exception to what is shown inside the square brackets. For example [^Ff] means anything except upper or lower case F [^a-z] means anything except lower case a through z When used outside the square brackets, the expression will look only at the beginning of the target string (Subject line of the ). For example - ^Inv will find Invoice and Inventory and Invention as the first word of the subject of an but will NOT find invoice, inventory and invention $ The $ will look only at the END of the . For example send$ will find any that ends with the word send without punctuation afterward

4 . The period (. ) means any character(s) in this position. For example, ept. will find exception and excepted but will not find except or inept because there are no characters that follow the ept Iteration Metacharacters? The? matches the preceding character 0 or 1 time only. For example colou?r will match either color or colour * The * matches the preceding character 0 or more times For example tre* will match tree (2 times), tread (1 time) and trough (0 times) + The + matches the previous character 1 or more times For example tre+ will match tree (2 times) and tread (1 time) but not trough (0 times) {n} Matches the preceding character or character range exactly n times. This is useful for phone numbers and account numbers. For example to find a phone number you could use the following: [0-9]{3}-[0-9]{3}-[0-9]{4} To find an 7 digit account number that starts with either AX or XX followed by a hyphen and 5 digits you could use the following: [AX]X-[0-9]{5} {n,m} Matches the preceding character at least n times but not more than m times

5 For example ba{2,3}b will find baab and baaab but not bab Additional Operations The pipe symbol ( ) is a Boolean OR that can be used in expressions to signify a match on 2 or more characters For example [W L]in will find Windows OR Linux. ( ) Open/Closed parenthesis can be used to group parts of the search expression together For example gr(a e)y will find both gray or grey \ Escape character required to treat special characters as their literal equivalents. For example [A-Z]{5}\)$ will find a string of 5 capital letters followed by a ) at the end of a line in an Advanced Expressions If-Then-Else There probably is really no good reason for a customer to try to set up an If-Then- Else scenario but if anyone thinks of it, we can try to provide example syntax as needed Comments It is ALWAYS a good idea to use comments so that you know what you intended to do (versus what is actually happening) with your regex. The syntax for a comment is (?#comment) where comment is whatever you want as long as it doesn t contain a closing parenthesis. Regex engines should ignore everything after the (?# and before the ending )

6 Compare these two examples the first without comments, the second with comments: Ex1 - (19 20)[0-9]{2}[- /.](0[1-9] 1[012])[- /.](0[1-9] [12][0-9] 3[01]) Ex2 - (?#YEAR)(19 20)[0-9]{2}[- /.](?#MONTH)(0[1-9] 1[012])[- /.](?#DAY)(0[1-9] [12][0-9] 3[01]) The comments in Ex2 are bolded above. CAUTION When using comments, if you put a space between the ending ) and the search string, you may not get the expected results For example, consider the difference between these two regex statements: Ex1 - (?#Comment - should be ignored)[a-z]{5}\#$ Ex2 - (?#Comment - should be ignored) [A-Z]{5}\#$ Note that the space at end of the comment in Ex2 will only match a string with a leading space. Performance Considerations Generally, from a performance perspective, customers should only be aware that using a Boolean OR ( ) is less efficient than specifying the characters side by side. Even though they effectively do the same thing, there is a cost in processing time. For example: [AaBbCcDd] is more efficient than [A a B b C c D d] How to Enable Regular Expressions in a Custom Content Group A Customer Administrator can enable Regular Expressions in an existing Content Group or by creating a new Content Group:

7 1. Login to the Control Console 2. Select the Protection tab 3. Select the Policies tab 4. Click Outbound Policies 5. Select the appropriate Outbound Policy and click Edit 6. Select the Content Tab 7. Select the Custom Content Groups tab 8. Select the appropriate Content Group 9. Add the expression in the Content box 10. Select the Enable regular expressions check box 11. Click Save How to Test a Regular Expression To test a Regular Expression being created follow these steps: 1. Login to the Control Console 2. Click the Protection tab

8 3. Click Policies 4. Click the Content tab 5. Click the Custom Content Groups tab 6. Enter the Regular Expression you are testing in the Regular Expression text box 7. Enter sample text to be searched in the Sample Text text box. The Regular Expression will be run against this sample text 8. Click Test Results will be displayed in the Results section. Note that the test will only return the first match of the expression. To test additional variations, edit the sample text accordingly.