search cancel

Can regex be used in the file name match in a response rule

book

Article ID: 173544

calendar_today

Updated On:

Products

Data Loss Prevention Endpoint Prevent Data Loss Prevention Network Prevent for Email Data Loss Prevention Network Discover Data Loss Prevention Network Protect Data Loss Prevention Endpoint Discover

Issue/Introduction

In Data Loss Prevention, for a response rule, can you use a regex expression in the file name under the "File Properties" - "Message Attachment or File Name Match" condition.

Resolution

No, regex is not supported.
For file name matching, the system supports the DOS pattern matching syntax to detect file names, including wild cards.
Any characters you enter (other than the DOS operators) match exactly.
To enter multiple file names, enter them as comma separated values or by line space.

The following operators are allowed in the file name:

  1. . - Use a dot to separate the file name and the extension.
  2. * - Use an asterisk as a wild card to match any number of characters (including none).
  3. ? - Use a question mark to match a single character.

For more information, see the "File name matching syntax" section of the Data Loss Prevention Administration Guide.
Symantec Data Loss Prevention Administration Guide

This applies to all version up to the current version, 15.5.
This may change in future versions.
Refer to the latest Data Loss Prevention Administration Guide.