Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Not applicable

Regular Expressions Examples

I thought it might be a good idea to start a thread where we can all post examples of Regular Expressions that we use to block spam. Or maybe some good web sites that we use to look up expressions. This is to help users who aren' t familiar with Regex (like I was when I first got my FG) to get them started and perhaps for all of us to find better expressions to use to keep spam to a minimum. Perhaps if this thread is useful it could be stickied to make it easier to find...
48 REPLIES 48
abelio

Hi laf,
still I don' t get this line: set pattern " /\\b0FF\\b/"
actually there' s an error in my first post (25-11-09) because the ' entries' definition is missing; repost from feb-19 has the correct syntax; Anyway: the issue could be triggered for the difference about how treat webGUI or CLI the regexp syntax. . you want to match 0FF string (a zero plus 2 uppercase F), so you use anchor \b to define boundaries; (to avoid to match C0FFEE for instance) . as \b is special, you need to escape it with another slash, so \\b0FF\\b . As you know, if you use regular expressions, is standard practice use delimiters to catch the pattern, i.e. /pattern/ or |pattern| or m{pattern}; webGUI it' s no strict to manage pattern, so you could keep \\b0FF\\b and within CLI you' ll see set pattern " \\b0FF\\b" If you want your regexp case insensitive, the // are now mandatory and the syntax would be set pattern " /\\b0FF\\b/i" ; but if not, above regexp should works Sorry by the typos and lack of precission in earlier posts. regards

regards




/ Abel

regards / Abel
laf
New Contributor II

our regexp case insensitive, the // are now mandatory and the syntax would be set pattern " /
Thank you sir!

The most expensive and scarce resource for man is time, paradoxically, it' s infinite.

The most expensive and scarce resource for man is time, paradoxically, it' s infinite.
Not applicable

I have recently learned more about regexs and have fixed all of the entries I had posted earlier to make them work better. In many of my examples I had posted entries containing badly formatted examples (like [1|!|a]). When using squared brackets the system looks for any letter that is within the brackets so the pipes are not necessary. Also, I had been doing [com|ca|org] thinking that I was chacking for a domain suffix when in fact we are looking for any of those letters. The correct way to look for groupings is (com|ca|org). As discussed before, \b looks for a non alphanumeric item (such as a space, period, comma, etc). It also seems to work with carriage returns so even if the word is the first word in the body or subject it is still detected when a \b is at the front of the regex. Wrapping single word entries in \b prevents things like the system detecing the sex in sexton, or the cum in cummings (that' s one I ran into), etc. So some of my revised entries look like this: /\bc[i1][a4@][il1!][il1!][sz]\b/i -> cialis, c1@lis, etc /\br[o0][l1!][e3]x\b/i -> rolex, r0lex, etc /\bunsubscr[i1!]b[e3]\b/i -> unsubscribe, unsubscr1be, etc /i am( so)? lonely/i /(setting|settings|setup)\.(zip|rar|exe)/i This should help some who are just starting with regex. The last one is intended to check for links within the body, not an attachment.
rwpatterson
Valued Contributor III

FYI ' \b' is border. Anything that separates alphanumeric from white space and/or punctuation, carriage return, etc.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
Not applicable

Okay, how do I block everything? A blank regular expression and/or wildcard?
abelio

ORIGINAL: taylork Okay, how do I block everything?
try with this regexp: ^.*$

regards




/ Abel

regards / Abel
Not applicable

I see someone here mentioned using sender=recipient as a filter. How would one apply that so that it blocks some of the spoofed email. Nearly 80% of our spam comes in spoofed in this condition. Thanks in advance.
Not applicable

I would like to blacklist any email address NOT from .com, .net, .org, .edu, .gov or .mil. So, what is the OPPOSITE of this regular expression?... /^[^ ]+@[^ ]\.(com|net|org|edu|gov|mil)$/i Thank you for your help!
rwpatterson
Valued Contributor III

Welcome to the forums. Would be easier to whitelist those extension, then next line block everything.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors