Creating DLP Advanced Data Pattern by using hexlified value of file name

Use the FileNameHexRe("<hexlified regex string>") in advanced pattern to match the file name with the specified regex. The FileNameHexRe("<hexlified regex string>") accepts a hex encoded form of regular expression for file name.

1. Find the Hexlify Value of the File Type:

   Use the python online tool to get its hexlified value for the file type.

   The following code is an example of how to get the hexlify value using the online python interpreter for .csv and .psd files:

   import binascii
   print(binascii.hexlify(b'\\.(csv|psd)$'))
   Output returned = 5c2e286373767c7073642924

   
   
   

   The FileNameHexRe function and its value can be used in an Advanced Data Pattern to match against a particular file name as below:

   Prototype: FileNameHexRe(<hex encoded regex pattern>)

   Replace <hex encoded regex pattern> with regex pattern encoded as a hexadecimal string.

   Example: FileNameHexRe("5c2e286373767c7073642924")

   The above function would return mime-types matching application/pdf.

2. Navigate to Protect > Objects > DLP Objects.
3. Click the green plus icon and select Advanced to create the data pattern.
   
   
   
   
   
4. Enter a name that is recognizable at the top. You can also provide a description for what the pattern is doing.
5. On the Match Criteria tab, enter the hexlify value for your file type in Expression in FileNameHexRe("xxxxxxxxxxxxxxx") format and save it.
   
   
   
6. Testing the pattern with a .csv file displays Match Successful! Verdict.
   The Match Successful! verdict is displayed only when the file name is present in Content-Disposition header field.