User-defined events and regular expressions

For Network IPS appliances, use regular expression syntax in a user-defined event to detect more than a single static text string.

Regular expressions are a combination of static text and variables that the Network IPS appliance uses to detect patterns in the contexts that you specify for user-defined events. Use regular expressions when you create user-defined events if you need the appliance to detect more than a single static text string.

You can use the following regular expression syntax in a user-defined event:
Meta-character Matches
(r) r
x x
xr x followed by the letter r
\s Either a space or a tab (not a hard break or newline)
\d Decimal digit
\" Double quote
\' Single quote
\\ Backslash
\n Newline (ASCII NL or LF)
\r Carriage return (ASCII CR)
\t Horizontal tab (ASCII HT)
\v Vertical tab (ASCII VT)
\f Formfeed (ASCII FF)
\b Backspace (ASCII BS)
\a Bell (ASCII BS)
\ooo Specified octal character code
\xhhh Specified hexadecimal character code
. Any character except newline
\@ Nothing (represents an accepting position)
"" Nothing
[xy-z] x, or anything between y and z, inclusive (character class)
[^xy-z] Anything but x, or anything between y and z, inclusive
"text" Literal text, without regard for meta-characters
r? R/r or nothing
r* Zero (0) or more occurrences (kleene closure)
r+ One or more occurrences of r (positive kleene closure)
r{m,n} R/r at least m times, at most n times (repeat operator)
r|l Either r or l (alternation operator)
r/l R/r only if followed by l (lookahead operator)
^r R/r only at the beginning of a line (bol anchor)
r$ R/r only at the end of a line (eol anchor)
r, l Any arbitrary regular expression
m, n An integer
x,y,z Any printable or escaped ASCII character
text A sequence of printable or escaped ASCII characters
ooo A sequence of up to 3 octal digits
hhh A sequence of hex digits