Regex to Data Identifier

[Anubhav Vij]

Hello,

I have created a regex expression and convert it as Data Identifier in Symantec DLP. Unfortunately it is not working and no incidents were logged. Can anyone help me out ? 
 

Here is My regex.

1.    \B[\(\[](?i)word[\)\]]\B

2.    [\(\[](?i)word[\)\]]

I want to search "word" phrase from "Subject" field only.

 

Thanks

[DLP Freak]

why wouldn't you just use a keyword match detection rule?

[Anubhav Vij]

@DLP Freak 

Yes, I know I can use keyword rule, but it would not be efficient if I want to apply to all policies. There would be lots of manual work and I have to go each policy and apply that rule!

[DLP Freak]

Symantec doesn't use traditional regular expression tokens. You will probably need to remove some such as \B and (?i).  I used the Symantec supplied DIs for reference.

[kollkash]

Have you tried to put "word" in the Pattern field, using the Pre- adn Post-validator characters to limit what you want and don't want present from a boundary perspective? You definitely cannot use any of the traditional regex patterns inside the DI Pattern field.

[Anubhav Vij]

Yes, I tried removing "\B", it didn't work. But If I remove "(?i)" the it would create a problem if anyone uses "word" keyword as case sensitive. Any other thoughts, I really appreciate it.

[Anubhav Vij]

Hello Kollkash,

Yes I have used as a expression too instead of Data Identifier, but it didn't work. Any other thoughts, really appreciate it.

[DLP Freak]

You could put multiple patterns to address case. For example:

word

WORD

Word

[Anubhav Vij]

Yes, I created regex pattern and the defined my words into Data Identifier. It's working