Adding or editing a regular expression classifier

Use the Patterns & Phrases > Regular Expression Properties page in the Data Security module of the Forcepoint Security Manager to create a pattern classifier either from scratch, or based on an existing classifier.

To create a pattern from scratch:

  1. Go to the Content Classifiers > Patterns & Phrases page.
  2. Use the toolbar at the top of the content pane to select New > Regular Expression.
  3. Enter a Name for the expression, such as Visa card.
  4. Enter a Description for this pattern, such as Visa credit card patterns.
  5. Use the Value field to enter a regular expression (regex), such as all 3-character strings followed by the sequence “123”. The expression should be compatible with Perl syntax.
    • The Forcepoint Security Manager does not validate your expression. Click the information icon for a list of valid values.
    • To include Unicode characters in your pattern, use the format \x{hex- number}.
  6. Click Exclude to exclude certain values from the pattern, then select either Pattern to exclude or List of phrases to exclude to define the pattern to exclude. Exclude should list exceptions to the rule.
    Note: The excluded patterns are applied to the matched values only, rather than the entirety of the post text.
    • Define the regex Pattern to exclude. Click the information icon for a list of valid values.
    • Define the List of phrases to exclude. Enter each phrase one by one, then click Add to add it to the list. These phrases, when found in combination with the pattern, affect whether the content is considered suspicious.

      Select a phrase and click Remove to remove selected phrases from the list.

  7. Click OK.

To base a classifier on an existing classifier:

  1. Go to the Patterns & Phrases page.
  2. Click the name of a classifier to use it as the basis for a new classifier.
    • Depending on whether the selected classifier is predefined or user-defined, different classifier properties can be edited.
    • Refer to Regular Expression Patterns for details about each predefined classifier.
  3. Change fields as needed.

    If you are starting from a predefined classifier, add or remove exclude values. No other fields can be edited.

  4. Click Save As at the top of the pane, then save the classifier under a new name.
    Warning: Forcepoint regularly updates classifiers with new regulations, but cannot update a classifier that has been saved under a new name. Be sure to keep customized classifiers up to date.