Creating a Regular Expression

Last Updated on Sun, 03 Apr 2022 | Security Appliance

Note

A regular expression matches text strings either literally as an exact string, or by using metacharacters so you can match multiple variants of a text string. You can use a regular expression to match the content of certain application traffic; for example, you can match a URL string inside an HTTP packet.

Use Ctrl+V to escape all of the special characters in the CLI, such as question mark (?) or a tab. For example, type d[Ctrl+V]g to enter d?g in the configuration.

See the regex command in the Cisco Security Appliance Command Reference for performance impact information when matching a regular expression to packets.

As an optimization, the security appliance searches on the deobfuscated URL. Deobfuscation compresses multiple forward slashes (/) into a single slash. For strings that commonly use double slashes, like "http://", be sure to search for "http:/" instead.

Table 21-1 lists the metacharacters that have special meanings. Table 21-1 regex Metacharacters

Character	Description	Notes
•	Dot	Matches any single character. For example, d.g matches dog, dag, dtg, and any word that contains those characters, such as doggonnit.
(exp)	Subexpression	A subexpression segregates characters from surrounding characters, so that you can use other metacharacters on the subexpression. For example, d(o\|a)g matches dog and dag, but do\|ag matches do and ag. A subexpression can also be used with repeat quantifiers to differentiate the characters meant for repetition. For example, ab(xy){3}z matches abxyxyxyz.

| Chapter 21 Using Modular Policy Framework_

Configuring Special Actions for Application Inspections (Inspection Policy Map) H

Table 21-1 regex Metacharacters (continued)

Character	Description	Notes
I	Alternation	Matches either expression it separates. For example, doglcat matches dog or cat.
?	Question mark	A quantifier that indicates that there are 0 or 1 of the previous expression. For example, lo?se matches lse or lose. Note You must enter Ctrl+V and then the question mark or else the help function is invoked.
*	Asterisk	A quantifier that indicates that there are 0, 1 or any number of the previous expression. For example, lo*se matches lse, lose, loose, and so on.
+	Plus	A quantifier that indicates that there is at least 1 of the previous expression. For example, lo+se matches lose and loose, but not lse.
{X}	Repeat quantifier	Repeat exactly x times. For example, ab(xy){3}z matches abxyxyxyz.
{x,}	Minimum repeat quantifier	Repeat at least x times. For example, ab(xy){2,}z matches abxyxyz, abxyxyxyz, and so on.
[abc]	Character class	Matches any character in the brackets. For example, [abc] matches a, b, or c.
[Aabc]	Negated character class	Matches a single character that is not contained within the brackets. For example, [Aabc] matches any character other than a, b, or c. [AA-Z] matches any single character that is not an uppercase letter.
[a-c]	Character range class	Matches any character in the range. [a-z] matches any lowercase letter. You can mix characters and ranges: [abcq-z] matches a, b, c, q, r, s, t, u, v, w, x, y, z, and so does [a-cq-z]. The dash (-) character is literal only if it is the last or the first character within the brackets: [abc-] or [-abc].
MM	Quotation marks	Preserves trailing or leading spaces in the string. For example, " test" preserves the leading space when it looks for a match.
A	Caret	Specifies the beginning of a line.
\	Escape character	When used with a metacharacter, matches a literal character. For example, \[ matches the left square bracket.
char	Character	When character is not a metacharacter, matches the literal character.
\r	Carriage return	Matches a carriage return 0x0d.
\n	Newline	Matches a new line 0x0a.
\t	Tab	Matches a tab 0x09.
\f	Formfeed	Matches a form feed 0x0c.

Configuring Special Actions for Application Inspections (Inspection Policy Map)

Table 21-1

regex Metacharacters (continued)

Table 21-1

regex Metacharacters (continued)

Character	Description	Notes
\xNN	Escaped hexadecimal number	Matches an ASCII character using hexadecimal (exactly two digits).
\NNN	Escaped octal number	Matches an ASCII character as octal (exactly three digits). For example, the character 040 represents a space.

To test and create a regular expression, perform the following steps:

Step 1 To test a regular expression to make sure it matches what you think it will match, enter the following command:

hostname(config)# test regex input_text regular_expression

Where the input_text argument is a string you want to match using the regular expression, up to 201 characters in length.

The regular_expression argument can be up to 100 characters in length.

Use Ctrl+V to escape all of the special characters in the CLI. For example, to enter a tab in the input text in the test regex command, you must enter test regex "test[Ctrl+V Tab]" "test\t".

If the regular expression matches the input text, you see the following message:

INFO: Regular expression match succeeded.

If the regular expression does not match the input text, you see the following message:

INFO: Regular expression match failed.

Step 2 To add a regular expression after you tested it, enter the following command:

hostname(config)# regex name regular_expression

Where the name argument can be up to 40 characters in length. The regular_expression argument can be up to 100 characters in length.

The following example creates two regular expressions for use in an inspection policy map:

hostname(config)# regex url_example example\.com hostname(config)# regex url_example2 example2\.com

Continue reading here: Managing Aip Ssm and Csc Ssm

Was this article helpful?

Creating a Regular Expression

Related Posts