Data Loss Prevention: Custom CCL with a specific expression

Question

Hi guys, SOPHOS Support cannot help me in that case, they always sind me a manual with not really good content inside for this topic. Maybe you can answer my question! We are using DLP by Sophos and want to check if a spec. content is inside of a file. W e have some files with sensitive information, and we want to create a rule so that every file that has the word or expression "Extra Oficial" is blocked from being transmitted. 
 I searched in some forums and communities that said it was enough to just use regular expressions, so I tested the regular expressions using the regex101 site to validate it works, but when I configure it in Sophos, it just doesn't work. 
 How should I configure this in Sophos DLP?

Qoosh · Accepted Answer

Hi Bruno, 
 Thanks for reaching out to the Sophos Community Forum. 
 When checking the site you're using here, this is not using the same syntax as Sophos' DLP engine uses. In the following article it is stated that "Perl syntax" is used. - Set up an advanced expression 
 I was able to use the following site for testing. The regex I tested successfully on a device is: (?i:extra\soficial) - The Perl Regex Tester

Data Loss Prevention: Custom CCL with a specific expression

Top Replies