Customized Expressions

Create customized expressions if none of the predefined expressions meet your requirements.

Expressions are a powerful string-matching tool. Ensure that you are comfortable with expression syntax before creating expressions. Poorly written expressions can dramatically impact performance.

When creating expressions:

  • Refer to the predefined expressions for guidance on how to define valid expressions. For example, if you are creating an expression that includes a date, you can refer to the expressions prefixed with "Date".

  • Note that a Trend Micro product follows the expression formats defined in Perl Compatible Regular Expressions (PCRE). For more information on PCRE, visit the following website:

    http://www.pcre.org/

  • Start with simple expressions. Modify the expressions if they are causing false alarms or fine tune them to improve detections.

There are several criteria that you can choose from when creating expressions. An expression must satisfy your chosen criteria before a Trend Micro product subjects it to a DLP policy. For details about the different criteria options, see Criteria for Customized Expression.