Using Regular Expressions (Regex) in Alert Rules

Regular expressions (also known as regex or regexp) based on ECMAScript language grammar can be used to allow more flexibility when defining alert rules, which is currently only supported to trigger alerts on Windows Client computers.

The Matches (Regex) comparison operator is used to define regex values in alert rules, instead of the other (Equals, Like, Not equals, Not like) comparison operators available.

To define an alert rule using the Matches (Regex) comparison operator, do the following:

1. Click the Alerts navigation link (on the left).

2. Click the Add button to add a new alert (or edit an existing alert by clicking anywhere on the required alert displayed in the grid).

3. On the Add Alert (or Edit Alert) page that opens, in the Rules section, in the first (left-hand) field, select one of the following parameters:

- Application

- Title

- Username

- Keystrokes (Windows/macOS)

- URL (Windows/macOS)

- Clipboard Copy (Windows/macOS)

- Clipboard Paste (Windows/macOS)

- File Upload (Windows/macOS)

NOTE: The following parameters cannot be used with the Matches (Regex) comparison operator:

- Command (Linux)

- Parameter (Linux)

- User Belonging to Domain Group (Windows/macOS)

- Computer Belonging to Domain Group (Windows)

4. In the second (middle) field, select the Matches (Regex) comparison operator.

5. In the third (right-hand) field, enter the value required as a regular expression (using ECMAScript grammar).

The screenshot above shows an example of using a regular expression to detect (i.e. trigger the alert on):

• The opening of any of 4 different browser applications.

6. If required, add additional alert rules by clicking the “+ Or” and “+ And” buttons to work in combination with each other using OR/AND logic.

The screenshot above shows an example of using a combination of rules with regular expressions to detect (i.e. trigger the alert on) both:

• The use of any of 4 different browser applications.

• AND pasting either:

- An email address (into the browser), e.g. while composing an email to be sent.

- OR a phone number (into the browser), e.g. while composing an email to be sent.

NOTE: The speed of processing may be affected if regular expressions are used that are very abstract or complex (e.g. where large numbers of permutations are possible, e.g. when using "*")

7. After valid values are entered into all the required fields on the page, click the Finish button (at the bottom of the page) to save the alert rule. 

8. Then, whenever the alert is triggered, the corresponding alert event is displayed in the Session Player as follows (for the alert rule example shown above):