Cisco Cisco Firepower Management Center 4000
28-28
FireSIGHT System User Guide
Chapter 28 Detecting Specific Threats
Detecting Sensitive Data
•
escaped characters that allow you to use the metacharacters as literal characters
•
six character classes
Metacharacters are literal characters that have special meaning within regular expressions. The
following table describes the metacharacters you can use when defining a custom data pattern.
following table describes the metacharacters you can use when defining a custom data pattern.
You must use a backslash to escape the characters in the following table for the sensitive data
preprocessor to interpret them correctly as literal characters.
preprocessor to interpret them correctly as literal characters.
The following table describes the character classes you can use when defining a custom sensitive data
pattern.
pattern.
Table 28-11
Sensitive Data Pattern Metacharacters
Metacharacter
Description
Example
?
Matches zero or one occurrence of the preceding
character or escape sequence; that is, the preceding
character or escape sequence is optional.
character or escape sequence; that is, the preceding
character or escape sequence is optional.
colou?r
matches
color
or
colour
{n}
Matches the preceding character or escape sequence
n
times.
For example,
\d{2}
matches
55
,
12
, and
so on;
\l{3}
matches
AbC
,
www
, and
so on;
\w{3}
matches
a1B
, 25C,
and so on;
x{5}
matches
xxxxx
\
Allows you to use metacharacters as actual characters
and is also used to specify a predefined character
class. See the
and is also used to specify a predefined character
class. See the
table for a description of the character classes
you can use in sensitive data patterns.
\?
matches a question mark,
\\
matches a backslash,
\d
matches numeric
characters, and so on
Table 28-12
Escaped Sensitive Data Pattern Characters
Use this escaped character...
To represent this literal character...
\?
?
\{
{
\}
}
\\
\
Table 28-13
Sensitive Data Pattern Character Classes
Character Class
Description
Character Class
Definition
Definition
\d
Matches any numeric ASCII character 0-9
0-9
\D
Matches any byte that is not a numeric ASCII character not 0-9
\l (lowercase “ell”) Matches any ASCII letter
a-zA-Z
\L
Matches any byte that is not an ASCII letter
not a-zA-Z