Data Loss Prevention

Hi, I've got an Enforce Server and Endpoint Server serving a small pool of machines and I'm having issues with one particular data identifier. Basically, I need to look for 12-character strings that will be made up from Uppercase/Lowercase/Numbers, but exclude anything that starts with 10. So for example, 10KFRP4AJCJ3 will be ignored but 11KFRP4AJCJ3 would be captured.

 

The data identifier we've come up with using regexr.com is below, this works perfectly with my test data.

([02-9][0-9]|[0-9][1-9]|[0-9A-Za-z][A-Za-z]|[A-Za-z][0-9A-Za-z])[0-9A-Za-z]{10}

 

However when we put this into a policy, it doesn't trigger any results. Upon looking at the documention, it appears that pipe characters aren't supported in data identifier expressions.

 

The closest I've been able to come up with that would work now is

([02-9A-Za-z][0-9A-Za-z])[0-9A-Za-z]{10}

But this also excludes things that start with 11-19 which is no good.

 

Can anyone offer advice on how I can capture this data?

 

Cheers

Gary

Regardless of the pattern you end up using, have you tried adding the “Exclude beginning characters” validator to exclude “10”?

Regardless of the pattern you end up using, have you tried adding the “Exclude beginning characters” validator to exclude “10”?

Ah, I'd completely over-looked that. That's sorted it, thanks very much! Can't believe it was that simple, derp :<

Also as an FYI..

([02-9][0-9]|[0-9][1-9]|[0-9A-Za-z][A-Za-z]|[A-Za-z][0-9A-Za-z])[0-9A-Za-z]

When build a Data Identifier (NOT a Regex Policy) the pipe ("|") is not a function that works in a Data Identifier.

Just create another line in the DI, and list out all of the possibilities.

[02-9][0-9][0-9A-Za-z]

[0-9][1-9][0-9A-Za-z]

[0-9A-Za-z][A-Za-z][0-9A-Za-z]

[A-Za-z][0-9A-Za-z][0-9A-Za-z]

 

I will ONLY work if using a REGEX policy.