When adding network targets under Definition in a destination profile, you can use exact or regex patterns for matching. Each line in this list must be a comment or a destination.
Comments
Comments are completely ignored during processing. Note that if a comment is included in the same line as a destination, the entry is invalid. UTF-8 is supported for comments.
To add a comment, start a line with a number sign (#) or semicolon (;). An empty line is also considered a comment. To create a multi-lined comment, add a number sign or semicolon to the start of each line.
Exact Matching
This section describes best practices and supported syntax for exact matching, including examples.
Tip
Domain matching is always case insensitive. Configuring the case sensitivity only applies to paths and queries.
IP, CIDR, or Range matching always evaluates the target IP. For proxied traffic, the proxy resolves the IP, which might differ from the client-side destination IP.
Best Practices for Exact Match
Consider the following best practices when adding destinations for exact matching:
- To match an original URL (e.g.,
https://www.netskope.com/), enter it in the following syntax:www.netskope.comor*.netskope.com(to match subdomains). Whilewww.netskope.com/is valid, using this syntax to match is not best practice. - Add ports only when your policies must target specific ports. For some use cases, using a service profile is more suitable.
- Destination profiles do not support schemes (
http://andhttps://) and you must specify the port instead. For example, to restrict matches to HTTPS only, add port443to the destination (e.g.,www.netskope.com:443). - Add paths to your destinations only when necessary as this limits matches to decrypted traffic.
- Avoid query strings as reordered parameters prevent matching. For query matching, using regex is recommended. Query strings restrict matches to specific URLs if the parameters and order match.
Supported Syntax for Exact Match
Ensure that you use the correct syntax when adding destinations to the destination profile for exact matching.
FQDNs
Enter a valid domain name (e.g., www.netskope.com). This only matches requests to the specified domain and does not match subdomains. International domain name (IDN) encoding is supported.
PQDNs
Enter an asterisk (*) before a valid domain name (e.g., *.netskope.com). This matches requests to the specified top-level domain (TLD) and all subdomains. For example, *.netskope.com matches the TLD netskope.com and all subdomains. IDN encoding is supported.
IPs
Enter a valid IPv4 address (e.g., 163.116.128.1). This matches requests targeting the specified IP address.
CIDR
Enter a valid IPv4 CIDR with the prefix CIDR (e.g., CIDR:163.116.128.1/24). This matches requests targeting the IP addresses in the specified CIDR.
Ranges
Enter a valid IPv4 range with the prefix RANGE (e.g., RANGE:163.116.128.10-163.116.128.19). This matches requests targeting the IP addresses in the specified range.
Ports
(Optional) Add a port to the end of a destination to limit matching to the specified port (e.g., www.netskope.com:80). Valid values for TCP and UDP ports are between 1 and 65535. However, note that port ranges are not supported.
Paths & Queries
(Optional) Add a path or query to the end of a destination to limit matching to the specified path or query (e.g., www.netskope.com/path?q=value).
Paths and queries use a “start with” operator while wildcards are unsupported (i.e., the asterisk is treated as a normal character).
Special characters are supported for paths and queries:
- The following non-encoded characters are supported:
!$&'()*+,-/:;=@[]_~ - The question mark (
?) separates the path and query. A query can include an additional question mark. - A number sign (
#) marks a URL segment, which only the HTTP client processes. It isn’t sent to the proxy as destination profiles reject it to prevent misconfiguration. - Other special characters must be URL encoded.
- The proxy evaluates the exact syntax the HTTP client sends.
To match a folder, add a trailing slash (/) after the path. For example, www.netskope.com/path/ matches only the path folder such as www.nestkope.com/path/ and www.netskope.com/path/file.html. It doesn’t match the following: www.netskope.com/path or www.netskope.com/path2/.
In contrast, www.netskope.com/path matches any URL starting with this path such as www.netskope.com/path, www.netskope.com/path/, www.netskope.com/path2/, www.netskope.com/path/file.html, and www.netskope.com/path_description.html.
Examples for Exact Match
The following are examples of valid exact match patterns.
# Examples of destinations supported in Destination Profiles # Lines starting with # or ; are comments; empty lines are also comments. # Syntax for exact match: (FQDN|PQDN|IP|CIDR|Range)[:Port][/Path[?Query]] ## Details for the main section (FQDN|PQDN|IP|CIDR|Range) # FQDN (Fully Qualified Domain Name) matches the exact domain only www.example.com # PQDN (Partially Qualified Domain Name) starts with *. # Matches the top domain and any subdomain *.example.com # IP based (also evaluates resolved domain) 163.116.128.80 # Range based (also evaluates resolved domain) RANGE:163.116.128.10-163.116.128.19 # CIDR based (also evaluates resolved domain) CIDR:163.116.128.0/17 ## Options can be added to the main section # [:Port] Option: restricts destination to a single port: www.example.com:8080 *.example.com:8080 163.116.128.80:8080 RANGE:163.116.128.10-163.116.128.19:8080 CIDR:163.116.128.0/17:8080 # [/Path[?Query]] Option: restricts to HTTP Path and Query string # Warning 1: Path and Query apply only to decrypted HTTP # Warning 2: Query matches exact parameters in order; best to use regex www.example.com/path www.example.com/path?q=value *.example.com/path *.example.com/path?q=value 163.116.128.80/path 163.116.128.80/path?q=value RANGE:163.116.128.10-163.116.128.19/path RANGE:163.116.128.10-163.116.128.19/path?q=value CIDR:163.116.128.0/17/path CIDR:163.116.128.0/17/path?q=value # Options can be combined, for example www.example.com:8080/path?q=value *.example.com:8080/path?q=value 163.116.128.80:8080/path?q=value RANGE:163.116.128.10-163.116.128.19:8080/path?q=value CIDR:163.116.128.0/17:8080/path?q=value
Regex
This section describes best practices, supported syntax, and unsupported syntax for regex matching, including examples.
Keep in mind that the regex patterns used for destination profiles are only supported in Netskope Proxy. Additionally, regex only evaluates the URL, not the resolved IP. If the domain is unknown, then the IP serves as the FQDN.
The key differences for evaluation are as follows. Before SSL decryption (with an SSL policy) and when traffic is not decrypted (with a Real-time Protection policy), the regex engine evaluates the FQDN string. After SSL decryption and if the port is standard (i.e., 80 for HTTP or 443 for HTTPS), the proxy evaluates the FQDN, path, and query. Otherwise, the proxy evaluates the FQDN, port, path, and query.
Best Practices for Regex
Consider the following best practices when adding destinations for regex matching:
- Use regex only when exact matching is impossible. For example, to match domains with subdomains, exact match (
*.netskope.com) works best. To match requests with paths starting with/search, use exact matching. - Regex is efficient for matching domains with multiple TLDs and matching query parameters.
- When writing regex, keep in mind that:
- Periods (
.) in domain names must be escaped. - Escaping slashes (
/) in paths is not required. - Regex evaluates the full URL, including domain, path, and query parameters. To match only the domain, isolate it in the syntax.
- Periods (
Supported Syntax for Regex
Ensure that you use the correct syntax when adding destinations to the destination profile for regex. Netskope partially supports syntax from PCRE (Perl Compatible Regular Expressions) 8.41 or higher.
Literals & Escapes
| Syntax | Description | Example |
|---|---|---|
| Literal characters | Plain characters | abc, foo |
| Escape sequences | Special character escapes | \., \*, \+, \?, \[, \] |
| Hexadecimal | \xhh | \x41 (character “A”) |
| Octal | \ooo | \101 (character “A”) |
| Unicode | \x{hhh...} | \x{1F600} (emoji) |
| Control characters | \n, \r, \t | \n (newline) |
The following are valid examples:
foo\.com # Matches "foo.com" \d+\.\d+\.\d+ # Matches IP format file\x2Etxt # Matches "file.txt"
Character Classes
| Syntax | Description | Example |
|---|---|---|
. | Any character (except newlines) | a.c to abc, a1c |
[abc] | Character set | [aeiou] |
[^abc] | Negated character class | [^0-9] |
[a-z] | Character range | [A-Za-z0-9] |
\d | Digit [0-9] | \d+ |
\D | Non-digit [^0-9] | \D+ |
\w | Word character [A-Za-z0-9_] | \w+ |
\W | Non-word character | \W+ |
\s | Whitespace | \s+ |
\S | Non-whitespace | \S+ |
\h | Horizontal whitespace | \h+ |
\H | Non-horizontal whitespace | \H+ |
\v | Vertical whitespace | \v+ |
\V | Non-vertical whitespace | \V+ |
The following are valid examples:
[0-9]{1,3}\.[0-9]{1,3} # Matches first two octets of IP
\w+@\w+\.\w+ # Simple email matching
\d{4}-\d{2}-\d{2} # Date format YYYY-MM-DD
Quantifiers
| Syntax | Description | Equivalent |
|---|---|---|
* | Zero or more times | {0,} |
+ | One or more times | {1,} |
? | Zero or one time | {0,1} |
{n} | Exactly n times | N/A |
{n,} | At least n times | N/A |
{n,m} | n to m times | N/A |
*? | Non-greedy zero or more | N/A |
+? | Non-greedy one or more | N/A |
?? | Non-greedy zero or one | N/A |
{n,m}? | Non-greedy range | N/A |
The following are valid examples:
a* # Matches "", "a", "aa", "aaa"
a+ # Matches "a", "aa", "aaa"
a? # Matches "", "a"
a{3} # Matches "aaa"
a{2,4} # Matches "aa", "aaa", "aaaa"
a*? # Non-greedy, prefers shortest match
<.*?> # Matches HTML tags (non-greedy)
Anchors
| Syntax | Description |
|---|---|
^ | Start of a string or line |
$ | End of a string or line |
\A | Start of an absolute string |
\Z | End of an absolute string |
\z | End of a strict string |
\b | Word boundary |
\B | Non-word boundary |
The following are valid examples:
^https:// # Must start with https:// \.com$ # Must end with .com \bword\b # Matches complete word "word" ^[a-z]+$ # Entire string must be lowercase letters
Groups and Alternation
Important
Groups in Hyperscan are non-capturing and don’t extract matched content.
| Syntax | Description | Limitation |
|---|---|---|
(abc) | Non-capturing group | This doesn’t capture content. |
(?:abc) | Explicit non-capturing | N/A |
a|b | Alternation (OR) | N/A |
(a|b|c) | Grouped alternation | N/A |
The following are valid examples:
(http|https|ftp):// # Matches multiple protocols (foo|bar)\.com # Matches foo.com or bar.com (?:www\.)?example\.com # Optional www.
Inline Modifiers
| Syntax | Description |
|---|---|
(?i) | Case insensitivity |
(?-i) | Turn off case insensitivity. |
(?m) | Multi-line mode |
(?s) | Single-line mode, i.e., . matches a newline. |
(?x) | Extended mode, i.e., ignore whitespaces. |
The following are valid examples:
foo(?i)bar(?-i)baz # Only bar is case-insensitive (?i)case-insensitive # Entire expression is case-insensitive (?x) \d+ \. \d+ # Extended mode, spaces ignored
Unicode
| Syntax | Description |
|---|---|
\x{hhh} | Unicode code point |
\p{L} | Unicode letters |
\p{N} | Unicode numbers |
\p{S} | Unicode symbols |
\p{Z} | Unicode separators |
\P{L} | Non-unicode letters |
HS_FLAG_UTF8 | UTF-8 mode |
The following are valid examples:
\p{L}+ # Matches letters in any language
\p{Han}+ # Matches Chinese characters
\x{1F600} # Matches specific emoji
Special Constructs
| Syntax | Description |
|---|---|
\Q...\E | Literal block |
(?#comment) | Comment |
Unsupported Syntax for Regex
The following is not supported in destination profiles.
| Syntax | Description |
|---|---|
(?=abc) | Positive lookahead |
(?!abc) | Negative lookahead |
(?<=abc) | Positive lookbehind |
(?<!abc) | Negative lookbehind |
(abc) capture | Extract matched content |
\1, \2 | Backreferences |
(?<name>...) | Named capturing groups |
\k<name> | Named backreferences |
\g{n} | Relative backreferences |
(?(condition)yes|no) | Conditional matching |
(?(1)yes|no) | Group-based conditional |
(?(R)yes|no) | Recursion conditional |
(?R) | Recurse entire pattern |
(?1) | Call subpattern |
(?&name) | Call named subpattern |
(?P>name) | Python-style recursion |
\G | Last match end position |
\K | Keep to left side |
(*UTF) | UTF mode declaration |
(*UCP) | Unicode properties |
(*ACCEPT) | Accept match immediately |
(*FAIL) | Force failure |
(*SKIP) | Skip |
(*PRUNE) | Prune |
(*COMMIT) | Commit |
Examples for Regex
The following are examples of valid regex patterns.
Example Regex Patterns for Multiple TLDs
The following are examples of regex expressions for matching Google searches on any supported TLD from the Google list of supported domains.
Example 1
This is an example of matching to all domains with an OR condition.
^(www\.)?google\.(com|ad|ae|al|am|as|at|az|ba|be|bf|bg|bi|bj|bs|bt|by|ca|cd|cf|cat|cg|ch|ci|cl|cm|cn|cv|cz|de|dj|dk|dm|dz|ee|es|fi|fm|fr|ga|ge|gg|gl|gm|gp|gr|gy|hn|hr|ht|hu|ie|im|iq|is|it|je|jo|ki|kg|kz|la|li|lk|lt|lu|lv|md|me|mg|mk|ml|mn|mu|mv|mw|ne|nl|no|nr|nu|pl|pn|pt|ro|ru|rw|sc|se|sh|si|sk|sn|so|sm|sr|st|td|tg|tl|tm|tn|to|tt|vg|vu|ws|com\.(af|ag|ai|ar|au|bd|bh|bn|bo|br|bz|cu|cy|do|ec|eg|et|fj|gh|gi|gt|hk|jm|kh|kw|lb|lc|ly|mm|mt|mx|my|na|ng|ni|np|om|pa|pe|pg|ph|pk|pr|py|qa|sa|sb|sg|sl|sv|tr|ua|uy|vc|ve|vn)|co\.(ao|bw|ck|cr|id|il|in|jp|ke|kr|ls|ma|mz|nz|th|tz|ug|uk|uz|ve|za|zm|zw))(/|$)
Example 2
This is an example of a broader TLD match.
^(www\.)?google\.(com?\.)?[a-z]{2,3}(/|$)
To match only the /search path:
^(www\.)?google\.(com?\.)?[a-z]{2,3}/search
Example Regex Pattern for Query
This is an example of blocking the keyword forbidden from a Google search.
^(www\.)?google\.(com?\.)?[a-z]{2,3}/search\?([^&]*&)*q=[^&]*forbidden([^&]*)
Example Regex Pattern for Keyword in Domain Name
This is an example of blocking the keyword forbidden anywhere in a domain name.
^[^/?]*forbidden[^/?]*(/|$)