How to set up your FortiWeb > Auto-learning > Recognizing data types

Recognizing data types

FortiWeb appliances recognize the data types of parameters by matching them with regular expressions. These regular expressions are categorized as either:

See also

Predefined data types

When you install FortiWeb, it already has some data type regular expressions that are predefined — default signatures for common data types so that you do not need to write them yourself. Initial ones are included with the FortiWeb firmware. If your FortiWeb is connected to FortiGuard Security Service updates, it can periodically download updates to its predefined data types. This will provide new and enhanced data types without any effort on your part. Simply use the new signatures in parts of the configuration where they are useful to you.

Predefined data type patterns cannot be used directly. Instead, they must be grouped before they can be used in other areas of the configuration. For details, see Grouping predefined data types.

To access this part of the web UI, your administrator’s account access profile must have Read and Write permission to items in the Server Policy Configuration category. For details, see Permissions.

Setting name Description
Pattern The regular expression used to detect the presence of the data type. Parameter values must match the regular expression in order for an auto-learning profile to successfully detect the data type, or for an input rule to allow the input.
Description A description of what the data type is. It may include examples of values that match the regular expression.
 

Select the blue arrow beside a pattern to expand the entry and display the individual rules contained in the entry.

Displays the name of the data type.

  • Address — Canadian postal codes and United States ZIP code and ZIP + 4 codes.
  • Canadian Postal Code — Canadian postal codes such as K2H 7B8 or k2h7b8. Does not match hyphenations such as K2H-7B8.
  • Canadian Province Name and Abbrev. — Modern and older names and abbreviations of Canadian provinces in English, as well as some abbreviations in French, such as Quebec, PEI, Sask, and Nunavut. Does not detect province names in French, such as Québec.
  • Canadian Social Insurance Number — Canadian Social Insurance Numbers (SIN) such as 123-456-789.
  • Chinese Postal Code — Chinese postal codes such as 610000.
  • Country Name and Abbrev. — Country names, codes, and abbreviations as they are known in English, such as CA, Cote d’Ivoire, Brazil, Russian Federation, and Brunei.
  • Credit Card Number — American Express, Carte Blanche, Diners Club, enRoute, Japan Credit Bureau (JCB), Master Card, Novus, and Visa credit card numbers.
  • Date/Time — Dates and times in various formats such as +13:45 for time zone offsets, 1:01 AM, 1am, 23:01:01, and 01.01.30 AM for times, and 31.01.2009, 31/01/2009, 01/31/2000, 2009-01-3, 31-01-2009, 1-31-2009, 01 Jan 2009, 01 JAN 2009, 20-Jan-2009 and February 29, 2009 for dates.
  • Denmark Postal Code — Danish postal code (“postnumre”) such as DK-1499 and dk-1000. Does not match codes that are not prefixed by “DK-”, nor numbers that do not belong to the range of valid codes, such as 123456 or dk 12.
  • Email — Email addresses such as
    admin@example.com
  • GPA — A student’s grade point average, such as 3.5, based upon the 0.0-to-4.0 point system, where an “A” is worth 4 points and an “F” is worth 0 points. Does not match GPAs weighted on the 5 point scale for honors, IB, or AP courses, such as 4.1. The exception is 5.5, which it will match.
  • GUID — A globally unique identifier used to identify partition types in the hard disk’s master boot record (MBR), such as BFDB4D31-3E35-4DAB-AFCA-5E6E5C8F61EA. Partition types are relevant on computers which boot via EFI, using the MBR, instead of an older-style BIOS.
Name
  • Indian Vehicle Number — An Indian Vehicle Registration Number, such as mh 12 bj 1780.
  • IP Address — A public or private IPv4 address, such as 10.0.0.1. Does not match IPv6 addresses.
  • Italian Mobile Phone — Italian mobile phone numbers with the prefix for international calls, such as +393471234567, or without, such as 3381234567. Does not match numbers with a dash or space after the area code, nor VoIP or land lines.
  • Kuwait Civil ID — Personal identification number for Kuwait, such as 273032401586. Must begin with 1, 2, or 3, and follow all other number patterns for valid civil IDs.
  • Level 1 Password — A string of at least 6 characters, with one or more each of lower-case characters, upper-case characters, and digits, such as aBc123. Level 1 passwords are “weak” passwords, generally easier to crack than level 2 passwords.
  • Level 2 Password — A string of at least 8 characters, with one or more each of lower-case characters, upper-case characters, digits, and special characters, such as aBc123$%. Level 2 passwords are moderately strong.
  • Markup/Code — HTML comments, wiki code, hexadecimal HTML color codes, quoted strings in VBScript and ANSI SQL, SQL statements, and RTF bookmarks such as:
    • #00ccff, <!‑‑A comment.‑‑>
    • [link url="http://example.com/url?var=A&var2=B"]
    • SELECT * FROM TABLE
    • {\*\bkmkstart TagAmountText}
    Does not match ANSI escape codes. They are detected as strings.
  • Microsoft Product Key — An alphanumeric key for activation of Microsoft software, such as ABC12-34DEF-GH567-IJK89-LM0NP. Does not match keys which are non-hyphenated, nor where letters are not capitalized.
  • Netherlands Postal Code — Netherlands postal codes (“postcodes”) such as 3000 AA or 3000AA. Does not match postal codes written in lower-case letters, such as 3000aa.
  • NINO — A United Kingdom National Insurance Number (NINO), such as AB123456D. Does not match NINOs written in lower-case letters, such as ab123456d.
  • Numbers — Numbers in various monetary, scientific, decimal, comma-separated value (CSV), and other formats such as 123, +1.23, $1,234,567.89, 1'235.140, and -123.45e-6. Does not detect some types, such as hexadecimal numbers (which are instead detected as strings or code), and US Social Security Numbers (which are instead detected as strings).
 
  • Personal Name — A person’s full or abbreviated name in English. It can contain punctuation, such as A.J Schwartz, Jean-Pierre Ferko, or Jane O’Donnell. Does not match names written in other languages, such as Renée Wächter or 林美
  • Phone — Australian, United States, and Indian telephone numbers in various formats such as (123)456-7890, 1.123.456.7890, 0732105432, and +919847444225.
  • Quebec Postal CodePostal codes written in the style sometimes used by Quebecers, with hyphens between the two parts, such as h2j-3c4 or H2J-3C4.
  • StringsAny string of characters, including all other data types, such as alphanumeric words, credit card numbers, United States social security numbers (SSN), UK vehicle registration numbers, ANSI escape codes, and hexadecimal numbers in formats such as user1, 123-45-6789, ABC 123 A, 4125632152365, [32mHello, and 8ECCA04F.
  • Swedish Personal Number — Personal identification number (“personnummer”) for Sweden, such as 19811116-7845. Must be hyphenated. Does not match PINs for persons whose age is 100 or greater.
  • Swedish Postal CodePostal codes (“postnummer”) for Sweden, with or without spaces or hyphens, such as S 751 70, s75170, or S-751-70. Requires the initial S or s letter. Does not match invalid postal codes such as ones that begin with a 0, or ones that do not begin with the letter S or s.
  • UAE Land Phone Telephone number for the United Arab Emirates, such as 04 - 3452499 or 04 3452499. Does not match phone numbers beginning with 01 or 08.
  • UK Bank Sort CodeBank sort codes for the United Kingdom, such as 09‑01‑29. Must be hyphenated.
  • Unix Device Name — Standard Linux or UNIX non-loopback wired Ethernet network interface names, such as eth0. Does not match names for any other type of device, such as lo, hdda, or ppp.
 
  • URIUniform resource identifiers (URI) such as:
    http://www.example.com
    ftp://ftp.example.com
    mailto:admin@example.com
  • US Social Security Number — United States Social Security Numbers (SSN) such as 123-45-6789.
  • US State Name and Abbrev. — United States state names and modern postal abbreviations such as HI and Wyoming. Does not detect older postal abbreviations ending with periods ( . ), such as Fl. or Wyo.
  • US Street Address — United States city and street address, possibly including an apartment or suite number. City and street may be either separated with a space or written on two lines according to US postal conventions, such as:
    123 Main Street Suite #101
    Honolulu, HI 10001
    Does not match:
  • ZIP + 4 codes that include spaces, or do not have a hyphen (e.g. “10001 - 1111” or “10001 1111”)
  • city abbreviations of 2 characters (e.g. “NY” instead of “NYC”)
  • Washington D.C. addresses
  • US ZIP Code — United States ZIP code and ZIP + 4 codes such as 34285‑3210.
  • Windows File Name — A valid windows file name, such as Untitled.txt. Does not match file extensions, or file names without their extensions.
See also

Grouping predefined data types

A data type group defines a set of predefined data types (see Predefined data types) that can be used in an auto-learning profile.

For example, if you include the Email data type in the data type group, auto-learning profiles that use the data type group might discover that your web applications use a parameter named username whose value is an email address.

The predefined data type group, named predefine-data-type-group, cannot be edited or deleted.

To configure a predefined data type group

1.  Go to Auto Learn > Predefined Pattern > Data Type Group.

To access this part of the web UI, your administrator’s account access profile must have Read and Write permission to items in the Server Policy Configuration category. For details, see Permissions.

2.  Click Create New.

A dialog appears.

3.  In Name, type a unique name that can be referenced by other parts of the configuration. Do not use spaces or special characters. The maximum length is 35 characters.

4.  In Type, mark the check box of each predefined data type that you want to include in the set, such as Email or Canadian Social Insurance Number.

If you know that your network’s HTTP sessions do not include a specific data type, omit it from the data type group to improve performance. The FortiWeb appliance will not expend resources scanning traffic for that data type.

To examine the regular expressions for each data type, see Predefined data types.

5.  Click OK.

6.  To use a data type group, select it when configuring either an auto-learning profile (see Configuring an auto-learning profile) or input rule (see Validating parameters (“input rules”)).

See also