For Network IPS appliances, use regular expression syntax in a user-defined event to detect more than a single static text string.
Regular expressions are a combination of static text and variables that the Network IPS appliance uses to detect patterns in the contexts that you specify for user-defined events. Use regular expressions when you create user-defined events if you need the appliance to detect more than a single static text string.
Meta-character | Matches |
---|---|
(r) | r |
x | x |
xr | x followed by the letter r |
\s | Either a space or a tab (not a hard break or newline) |
\d | Decimal digit |
\" | Double quote |
\' | Single quote |
\\ | Backslash |
\n | Newline (ASCII NL or LF) |
\r | Carriage return (ASCII CR) |
\t | Horizontal tab (ASCII HT) |
\v | Vertical tab (ASCII VT) |
\f | Formfeed (ASCII FF) |
\b | Backspace (ASCII BS) |
\a | Bell (ASCII BS) |
\ooo | Specified octal character code |
\xhhh | Specified hexadecimal character code |
. | Any character except newline |
\@ | Nothing (represents an accepting position) |
"" | Nothing |
[xy-z] | x, or anything between y and z, inclusive (character class) |
[^xy-z] | Anything but x, or anything between y and z, inclusive |
"text" | Literal text, without regard for meta-characters |
r? | R/r or nothing |
r* | Zero (0) or more occurrences (kleene closure) |
r+ | One or more occurrences of r (positive kleene closure) |
r{m,n} | R/r at least m times, at most n times (repeat operator) |
r|l | Either r or l (alternation operator) |
r/l | R/r only if followed by l (lookahead operator) |
^r | R/r only at the beginning of a line (bol anchor) |
r$ | R/r only at the end of a line (eol anchor) |
r, l | Any arbitrary regular expression |
m, n | An integer |
x,y,z | Any printable or escaped ASCII character |
text | A sequence of printable or escaped ASCII characters |
ooo | A sequence of up to 3 octal digits |
hhh | A sequence of hex digits |