Cisco Cisco FirePOWER Appliance 7115

Version 5.3

Sourcefire 3D System User Guide

1119

Understanding and Writing Intrusion Rules

Understanding Keywords and Arguments in Rules

Chapter 30

Character Classes

: Protection

Character classes include alphabetic characters, numeric characters, 

alphanumeric characters, and white space characters. While you can create your 

own character classes within brackets (see 

 on page 1118), you 

can use the predefined classes as shortcuts for different types of character types. 

When used without additional qualifiers, a character class matches a single digit 

or character.

()

Groups expressions.

(abc)+

 matches 

abc

, 

abcabc

, 

abcabcabc

 and so on.

{}

Specifies a limit for the number of 

matches for a character or expression. If 

you want to set a lower and upper limit, 

separate the lower limit and upper limit 

with a comma. 

a{4,6}

 matches 

aaaa

, 

aaaaa

, or 

aaaaaa

.

(ab){2}

 matches 

abab

.

[]

Allows you to define character classes, 

and matches any character or 

combination of characters described in 

the set. 

[abc123]

 matches 

a

 or 

b

 or 

c

, and so 

on.

^

Matches content at the beginning of a 

string. Also used for negation, if used 

within a character class.

^in

 matches the “in” in 

info

, but not in 

bin

. 

[^a]

 matches anything that does 

not contain 

a

.

$

Matches content at the end of a string.

ce$

 matches the “

ce

” in 

announce

, but 

not 

cent

.

|

Indicates an OR expression.

(MAILTO|HELP)

 matches 

MAILTO

 or 

HELP

.

\

Allows you to use metacharacters as 

actual characters and is also used to 

specify a predefined character class.

\.

 matches a period, 

\*

 matches an 

asterisk, 

\\

 matches a backslash and so 

on. 

\d

 matches the numeric characters, 

\w

 matches alphanumeric characters, 

and so on. See 

page 1119 for more information about 

using character classes in PCRE.

PCRE Metacharacters (Continued)