Custom Filters...I need to filter on any 6 number strings

mnemec_ironport · ‎10-20-2008

Can anyone out there let me know how to set a filter for this?
Would "\#?" work? It seems like I need to put in a parameter for 6, but I am not sure how.

MN

kluu_ironport · ‎10-21-2008

\d is for any digit
\b is a word boundary

Try this:

\d\d\d\d\d\d

The above will match 6 numbers in a roll, even if wedged between letters (i.e. test123456test )

or

\b\d\d\d\d\d\d\b

The above will match the same thing but be stricter in that the character to the left and the right cannot be a special character or letter I believe. Test both and see what you're more comfortable with.

Jason Meyer · ‎10-21-2008

Not trying to hijack this thread but was wondering if there are any good books on writing these custom message filters. I understand it is based on Python but that's about it... any good guides?

kluu_ironport · ‎10-21-2008

Funny you should ask. Here's a good starting point. One of our sales engineer compiled this Support Portal knowledge base article together. There are links to Python regex guides and examples of how to test.

How do I test regular expressions before using them in a filter?

http://tinyurl.com/ecl75

How do I test regular expressions before using them in a filter?

The regular expressions in IronPort filters are Python regular expressions. There is a Python regular expression debugging tool at http://kodos.sourceforge.net. In addition to the AsyncOS User Guide (see below), you can use some of the following Internet resources to help understand the syntax of regular expressions in IronPort filters:
http://kodos.sourceforge.net/help/overview.html
http://docs.python.org/lib/module-re.html
http://diveintopython.org/regular_expressions

For Windows users, there is another product to test regular expressions: http://sourceforge.net/projects/regulator/

The Trace command can also be useful in testing regular expressions. However, the Trace command (in both the GUI and CLI) works only on committed changes. This means that you must have your regular expression "in production" to use Trace. You can write a filter that has only the regular expression and no actions if you want to test the regular expression using Trace without fully committing your message filter or content filter to production operation.

You can also use a system quarantine to test regular expressions in filter rules. For more information, refer to Answer ID 87: How do I test and debug a message filter or a content filter before I put it into production?" title="Answer ID 87.

For more information about message filter rules, see the AsyncOS Advanced User Guide on the IronPort Support Portal[http://www.ironport.com/support/login.html].

rouben_ironport · ‎10-22-2008

I'm going to chime in with my favourite RegExp tool built in Flash (that means no downloading/installing anything).

http://gskinner.com/RegExr/