The expression match-mode command configures the expression string of user-defined keywords.
The undo expression command deletes the expression string of user-defined keywords.
| Parameter | Description | Value |
|---|---|---|
| text | Indicates text expression for user-defined keywords. | - |
| regular | Indicates regular expression for user-defined keywords. | - |
| text | Specifies the character string of a user-defined keyword. | The value is a case-sensitive string of 3 to 200 characters. If the keyword contains any space or question mark (?), the value is a string of 5 to 202 characters and must be enclosed with double quotation marks (""), for example, "GET w?". If the keyword contains quotation marks, replace the quotation marks with \x22, for example, to set keyword abc"d, enter abc\x22d. |
You can configure text expression or regular expression for user-defined keywords that are to be identified.
In text expression mode, keywords are expressed as text strings. For example, you can use the text confidential file to identify a keyword. Text expression is accurate and easy to configure.
Unlike text expression, one regular expression identifies multiple keywords. For example, character . in regular expression abc.de matches any character. Therefore, abc.de can identify abcxde, abcyde, or abc8de.
Regular expression is flexible and highly efficient.
# Configure the user-defined keyword test-keyword in text expression mode.
<sysname> system-view [sysname] keyword-group name abc [sysname-keyword-group-abc] user-defined-keyword name def [sysname-keyword-group-abc-keyword-def] expression match-mode text test-keyword
# Configure user-defined keyword testexpression|detectstring in regular expression mode.
<sysname> system-view [sysname] keyword-group name abc [sysname-keyword-group-abc] user-defined-keyword name def [sysname-keyword-group-abc-keyword-def] expression match-mode regular testexpression|detectstring