cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Cisco Secure Email Support Community

Product Support Talos Support Cisco Support Reference + Current Release
Gateway Reputation Lookup Open a support case Secure Email Guided Setup
Gateway: 14.0.1-033
Cloud Gateway Email Status Portal Support & Downloads docs.ces.cisco.com
Email and Web Manager: 14.0.0-418
Email and Web Manager Web & Email Reputation Worldwide Contacts Product Naming Quick Reference
Reporting Plug-in: 1.1.0.136
Encryption Bug Search
Encryption Plug-in: 1.2.1.167
Cloud Mailbox Notification Service
Outlook Add-in(s): More info

582
Views
0
Helpful
1
Replies
Analyst42
Beginner

Regex content filtering

Hi,

 

i'm dealing with problem with dictionary filtering. I add regex term to dictionary blocked_dictionary which is used in Default Policy because i need to filter all incoming mails.

 

Regex term >  \s(bc1|[13])[a-zA-HJ-NP-Z1-9]{25,39}\w

 

Problem is, that regex matching terms which starts without space character, for example:

JJT//
1fVUkkklNXNqFpraaDd9LUPLNvDeQW/SlVn

Definition > \s  matches any whitespace character

 

I tested in regex101, regexr many times but every time without match. Is there any what i am doing wrong?

 

Thanks, have a nice day

 

1 REPLY 1
Mathew Huynh
Cisco Employee

Hey Analyst,

 

I looked into the rule and did some tests on my own and it seems to adhere what we see on regex101 as well. For your tests, are you able to share the body content you're using in the test?

 

Note: you can use the system admin -> trace functionality to run validations if needed


Depending on which item you ticked in your dictionary as well it may match slightly differently; however it has always worked for me on my testing.

 

Thanks,

Mathew