RegEx Pattern for Danish SSN in Data Filtering Profile

Overview

The Danish SSN is composed of 10 digits with a dash/hyphen between the 6th and 7th digit (for example, 120965-1472). The first 6 digits are the date of birth (day, month, year) and the last 4 digits uniquely identify people born on the same day. To detect outbound emails that include a Danish SSN, a custom regex pattern can be applied to a data filtering profile on the Palo Alto Networks firewall.

In PAN-OS, each regex pattern must include a fixed 7-byte string in order to be valid.  The string "subject" can be included to key the pattern for an email. Therefore, the basic regex pattern, valid in PAN-OS, would be the following:

     .*(subject).*(.([0-3][0-9][0-9][0-9][0-9][0-9])\-([0-9][0-9][0-9][0-9]).).*

Note: The regex above can be enhanced to further limit the pattern matches.

See Also

Data Patterns section in the PAN-OS Admin Guide

owner: kadak