RegEx statement to recognise UPN numbers

[Marshall_IT]

Hi all,

 

I've gotten mail encryption working in office 365 and I'm looking to automatically encrypt or block messages using DLP.

 

So I'm looking for regex statement to find a upn and other for any other potentially sensitive info.

 

I'm thinking something like this for the upn

 

A|B|C|D|E|F|G|H|J|K|L|M|N|P|Q|R|T|U|V|W|X|Y|Z............

 

Is there a better option to find 12 decimals following one of the characters above?

 

Are there too many LEAs to put those as an option into the statement?

 

I could use the local lea but I'd be missing any students out of my local lea.

 

 

Any help / ideas very greatly appreciated.

[Arthur]

Is there a better option to find 12 decimals following one of the characters above?

Definitely!

 

[a-zA-Z]{1}\d{12}

 

or better still (since it won't match if the UPN starts with an I, O or S)...

 

[a-hA-Hj-nJ-Np-rP-Rt-zT-Z]{1}\d{12}

 

Btw, RegExr is a good website for testing regular expressions.

Edited July 4, 2014 by Arthur
Fixed RegEx as I had it backwards

[Marshall_IT]

Thank you.

[mats]

 

Btw, RegExr is a good website for testing regular expressions.

 

I like that site. Similar to Rubular: a Ruby regular expression editor and tester

[Marshall_IT]

Although that statement is completely correct it doesn't work in office 365, exchange online rules section

 

i've had to alter it to be

 

.\d\d\d\d\d\d\d\d\d\d\d\d

 

while this will/could pull up a few false positives i shouldn't let through any genuine UPNs.

[Marshall_IT]

Definitely!

 

 

or better still (since it won't match if the UPN starts with an I, O or S)...

 

[a-hA-Hj-nJ-Np-rP-Rt-zT-Z]{1}\d{12}

 

This did actually work i just wasn't waiting long enough for Office 365 to sync the rules. they can take up to 4 hours which makes testing regex statements a pain!

 

- - - Updated - - -

 

Definitely!

 

 

or better still (since it won't match if the UPN starts with an I, O or S)...

 

[a-hA-Hj-nJ-Np-rP-Rt-zT-Z]{1}\d{12}

 

This did actually work i just wasn't waiting long enough for Office 365 to sync the rules. they can take up to 4 hours which makes testing regex statements a pain!

[Arthur]

This did actually work I just wasn't waiting long enough for Office 365 to sync the rules. They can take up to 4 hours which makes testing regex statements a pain!

Thanks for the update. That's good to know!

 

At least you can use the correct regex now and you shouldn't get any false matches.

[jthompson]

Digging up this thread rather than starting a new one. I'm looking at creating a DLP rule in G Suite to look for UPNs. I've arrived at the following regex.

(\A|[^a-zA-Z0-9])[a-zA-Z][0-9]{11}[a-zA-Z0-9]([^a-zA-Z0-9]|\z)

Just thought I'd share it in case people are either after one, or have a better one. It accounts for UPNs that are bracketed or with commas either side, etc.

[smithson83]

Sorry to dig up an dug up old thread... I was just looking into RegEx for UPN etc, and found this thread.

 

Do people have any other RegEx strings they use for other sensitive info about kids? ie is it possible to have a regex that take age into account when looking for dates (eg 99/99/9999 between 10-16 years ago)

[jthompson]

You'd be able to craft a regex that did that, but you'd have to consider the different date formats, too, and have a regex that accounted for those as well (or multiple regexes).

 

i.e. DD/MM/YYYY, DD/MM/YY, DD-MM-YYYY, D-M-YYYY, DD MMMM YYYY, etc.

 

G Suite has a premade condition (in Admin -> Rules) for date of birth (Global - Date of Birth). Not used it though, so I don't know how it would differ from just using a regex as you've described. It maybe looking at wider context of the document, so that it scores it more likely if it detects stuff like "DoB" or "Surname" also in the document.

[smithson83]

I was thinking more like

dd/mm/yyyy where yyyy is between $ThisYear-10 and $ThisYear-17

 

to catch dates for kids DoB's, but also changes as the years roll over

[Arthur]

I was thinking more like

dd/mm/yyyy where yyyy is between $ThisYear-10 and $ThisYear-17

Not quite what you're after, but the following regex will match dates in the range 2002-2009.

 

https://regex101.com/r/pLNYuK/2

 

^(0[1-9]|[12][0-9]|3[01])[-\/.](0[1-9]|1[012])[-\/.](200[2-9])$

 

Edited February 13, 2019 by Arthur

[Arthur]

A slight change to the regex above (this will match the same dates anywhere in a string, not just at the beginning of a line)...

 

https://regex101.com/r/pLNYuK/3

 

(0[1-9]|[12][0-9]|3[01])[-\/.](0[1-9]|1[012])[-\/.](200[2-9])