Since the built in SSN classifiers on the ESAs have a lot of false positives, Cisco support suggested creating regular expressions when creating DLP policies. I am trying to develop a custom DLP policy using a regular expression in a custom classifier using the following rules rules:
A Social Security number CANNOT :
- Contain all zeroes in any specific group (e.g 000-##-####, ###-00-####, or ###-##-0000)
- Begin with ‘666’.
- Begin with any value from ‘773-999′
- Be ‘078-05-1120′
- Be ‘219-09-9999′
- Be ‘123-45-6789′
Her is my regex:
^(?!000|666|77[3-9]|8[0-9]{2})[0-9]{3}\-(?!00)[0-9]{2}\-(?!0000)[0-9]{4}$
It works with regex testers, but my ESA does not catch valid test data. Any suggestions?
