Symantec DLP does not detect incidents when using "\b" regex in custom data identifier
Article ID: 164362
Updated On:
Products
Issue/Introduction
A custom data identifier created with a regular expression pattern that uses the "\b" operator will cause FileReader to not properly detect incidents.
Example Regex Pattern that utilizes the "\b" operator:
\b([0-9]{3.EN_US})([ ]?)([0-9]{3.EN_US})([ ]?)([0-9]{2,3})\b
The following errors are observed in the FileReader logs on detection servers if the "\b" operator is used in a data identifier policy:
FileReader0.log
Dec 27, 2016 7:28:33 AM com.vontu.detection.DetectionChain processMessage
WARNING: Error processing message [A88F91EC-A7EF-4107-857D-38572A4F9B4D]
java.lang.IllegalArgumentException: <\b> not a valid letter for index.
at com.vontu.detection.dataidentifier.PatternUtil.convertLetterToArrayIndex(PatternUtil.java:63)
at com.vontu.detection.dataidentifier.PatternUtil.convertLetterToArrayIndex(PatternUtil.java:68)
at com.vontu.detection.dataidentifier.patternfsm.FsmUtil.findBestNodeMatch(FsmUtil.java:53)
at com.vontu.detection.dataidentifier.patternfsm.PatternFsm.addLinksToAllNodes(PatternFsm.java:112)
at com.vontu.detection.dataidentifier.patternfsm.PatternFsm.addPattern(PatternFsm.java:87)
at com.vontu.detection.dataidentifier.patternfsm.PatternFsm.addPatternType(PatternFsm.java:61)
at com.vontu.detection.dataidentifier.pattern.FSMPatternCompiler.compile(FSMPatternCompiler.java:47)
at com.vontu.detection.dataidentifier.api.DataIdentifierBuilder.getPattern(DataIdentifierBuilder.java:80)
at com.vontu.detection.dataidentifier.api.DataIdentifierBuilder.build(DataIdentifierBuilder.java:49)
at com.vontu.detection.policy.engines.dataidentifier.DataIdentifierService.lookup(DataIdentifierService.java:37)
at com.vontu.detection.policy.engines.dataidentifier.DataIdentifierCompiledCondition.execute(DataIdentifierCompiledCondition.java:121)
at com.vontu.detection.policy.engines.dataidentifier.DataIdentifierCompiledCondition.evaluate(DataIdentifierCompiledCondition.java:97)
at com.vontu.detection.policy.engines.dataidentifier.DataIdentifierCompiledCondition.evaluate(DataIdentifierCompiledCondition.java:74)
at com.vontu.detection.execution.HephaestusExecutor.execute(HephaestusExecutor.java:254)
at com.vontu.detection.execution.HephaestusExecutor.execute(HephaestusExecutor.java:221)
at com.vontu.detection.execution.HephaestusExecutor.execute(HephaestusExecutor.java:116)
at com.vontu.detection.execution.HephaestusExecutor.execute(HephaestusExecutor.java:82)
at com.vontu.detection.DetectionChain.processMessage(DetectionChain.java:102)
at com.vontu.messaging.chain.MessageChain.processMessage(MessageChain.java:170)
at com.vontu.messaging.chain.MessageChain.run(MessageChain.java:96)
at java.lang.Thread.run(Thread.java:745)
Environment
This issue was observed in DLP version 14.0.1 and on Network Prevent for Email servers.
The issue is also observed in DLP 15.x Endpoint Agents
Cause
The Enforce console will allow users to enter the "\b" operator and save the data identifier successfully. The "\b" operator is not a valid regex parameter for the Java implementation of Regex that Symantec DLP utilizes.
Resolution
Remove the "\b" regex operator from any custom data identifier patterns and save changes. Symantec is aware of this issue and will be updating functionality in a future version to prevent the "\b" from being utilized as a valid input parameter.
The data identifier pattern language is a limited subset of the regular expression lexicon. The data identifier pattern language does not support all of the regular expressions characters and constructs. A regular expression pattern converted to a data identifier pattern will require some syntactical modifications.
It only supports the character classes of \w, \s, and \d
Ref: - https://techdocs.broadcom.com/us/en/symantec-security-software/information-security/data-loss-prevention/15-8/about-data-loss-prevention-policies-v27576413-d327e9/introducing-data-identifiers-v40848904-d327e38432/creating-custom-data-identifiers-v95987504-d327e53449/using-the-data-identifier-pattern-language-v63306501-d327e53863.html
Feedback
