McAfee Data Loss Prevention 9.2.2 Product Guide

11Managing conceptsAdd, apply, restore, and delete conceptsTable 11-1 Supported regular expressions (continued)Expression Definition\s any space [\ < > ; \f \n \r \t \[ \]]\S not any space ^\s\p any space or field delimiter [\ ‐\\ :‐@\[‐`{‐~ \[ \]]\P not any space or field delimiter ^\p\i case sensitivity off\I case sensitivity on[...] character sets, for example, [3‐6a‐c] = 3,4,5,6,a,b,cx‐y^character ranges T‐X = T,U,V,W,Xinvert, for example, ^\0x0 are all characters except NULL\ literal backslash (transforms metacharacters into ordinary characters). Examples: \\ \.\& \[ \] \ \* \+Add, apply, restore, and delete conceptsConcepts must be maintained to match changing data patterns and session content. In addition to thestandard concept parameters, you can set conditions to matches based on extraneous factors, or usethem to extend rules.Tasks• Add content concepts on page 234Add content concepts to match text patterns and regular expressions to data in traffic orrepositories.• Set conditions for matching concepts on page 236Set limitations on concepts that instruct the system to report matches only if certainconditions are met.• Add session concepts on page 236Add session concepts to inspect all communications between two parties when a pattern ismatched. Because the session layer is monitored, you will be able to find multiple objectscontained in a single flow (for example, an email attachment as well as the mail body).• Apply concepts to rules on page 237Apply content concepts to rule definitions to match patterns in data traffic or repositories.• Restore user-defined concepts on page 238Restore the User‐Defined concepts to their original state if they have become corrupted ordifficult to handle.• Delete custom concepts on page 238Delete custom concepts from the Concepts page if they are no longer useful.Add content conceptsAdd content concepts to match text patterns and regular expressions to data in traffic or repositories.When creating concepts that have multiple words, you must escape spaces between words with abackslash (for example, \_). You can add up to 512 content and session concepts to match patterns innetwork and repository data.234 McAfee Data Loss Prevention 9.2.2 Product Guide