Creating Content Matches Regular Expression rule in V9

book

Article ID: 160796

calendar_today

Updated On:

Products

Data Loss Prevention Enforce

Issue/Introduction

How to execute the "look ahead" and "look behind' clauses in Regex for V9.

Resolution

Relevant version:  V9 and up

In version 9, the standard Look Ahead and Look Behind clauses are stripped from the regular expression and executed separately in Java. This significantly improves the regular expression performance. To achieve the improved performance, the look ahead and look behind sections must exactly match one of the supported standard sections. If either section differs even slightly, that section is executed as part of the regular expression without performance improvement.

The following standard sections are supported by the performance improvement:

Look Ahead: (?=(?:[^-\w])|$)

Look Behind: (?<=(^|(?:[^)+\d][^-\w+]))) and (?<=(^|(?:[^)+\d][^-\w+])|\t))

NOTE:  After adding a regular expression rule, observe the system for about one hour to ensure that the system does not slow down too much (unlikely, but possible) and that there are no unexpected false positives.

See also: 

KB 43270: Can Regex be used to find a pattern for a file?

KB 42749: How to Create More Efficient Regular Expressions