The short answer is "Yes, it can."
The detailed answer, though, requires further information to be properly provided.
In order to determine what signature engine to use, you have to consider the traffic you want to inspect. Obviously, inspecting LDAP over TCP would be done using a different signature engine than what you would use to look for the same data in IM traffic via UDP. If you want to check out if this data is available via people accessing a web server, yet another signature engine is required.
The next trick is to properly construct your regular expression (aka - regex) in order to identify and report the data your looking for. If you're looking for many disparate data types, you might be better off creating signatures for each data element you want to find (one for phone numbers, one for e-mail addresses).
Also, when constructing the regex, you have to determine if you're looking for known values (555-1212 or me@you.net) or just data that resembles what you want to find (anything that resembles NNN-NNNN or
@.).
Obviously, the regex gets far more complicated if your matching format versus a known pattern.
Anyway, those are the big ones. The final consideration involves the reporting parameters. If you want to know about each and every pattern match, you'll configure the signature one way. If you just want to know that it's seeing packets with your pattern in it and receive an update at a set interval (say, 30 minutes), you'd configure it another way.
In summary, you can definitely build a signature to identify and alert based on contents of a packet. You just need to do a bit of planning in order to build one that will meet your needs effectively.
I hope this helps,
Alex Arndt
