Forum Discussion

Nikoolayy1's avatar
Nikoolayy1
Icon for MVP rankMVP
Jun 20, 2022
Solved

F5 Data Guard and Microsoft Azure Information Protection (AIP)

As the F5 Data Guard can match of words or regex patterns it should have no issue matching the Microsoft Azure Information Protection (AIP) labels as they are strings in the file's body like "" . Can someone confirm this?

 

 

https://docs.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels?view=o365-worldwide

 

 

Data Pattern example: "MSIP_Label_2096f6a2-d2f7-48be-b329-b73aaa526e5d_Enabled"

 

https://docs.microsoft.com/en-us/information-protection/develop/concept-mip-metadata

application delivery
security
  • Lior_Rotkovitch's avatar
    Lior_Rotkovitch
    Jun 20, 2022

    Try Custom Patterns: 

    MSIP_Label_\w{8}-\w{4}-\w{4}-\w{4}-\w{12}_(Enabled|SiteId|ActionId|Method|SetDate|Name|ContentBits)

    note: I didn't fully test it, It should work fine. if not please let me know. 

4 Replies

Sort By
  • Lior_Rotkovitch's avatar
    Lior_Rotkovitch
    Icon for SIRT rankSIRT
    Jun 20, 2022

    Try Custom Patterns: 

    MSIP_Label_\w{8}-\w{4}-\w{4}-\w{4}-\w{12}_(Enabled|SiteId|ActionId|Method|SetDate|Name|ContentBits)

    note: I didn't fully test it, It should work fine. if not please let me know. 

    • Nikoolayy1's avatar
      Nikoolayy1
      Icon for MVP rankMVP
      Jun 20, 2022

      Thanks for making full regex but as I still do not have AIP license I was just looking for confimation that a label like ''MSIP_Label_2096f6a2-d2f7-48be-b329-b73aaa526e5d_Enabled'' can be matched as this way just specific labels can be blocked and you made a full regex how to match AIP labels as a whole and this is great!

  • Amine_Kadimi's avatar
    Amine_Kadimi
    Icon for MVP rankMVP
    Jun 21, 2022

    Hi,

    Just in case, you can validate your regex using the Regexp Validator tool at Security > Options > Application Security > RegExp Validator

  • Nikoolayy1's avatar
    Nikoolayy1
    Icon for MVP rankMVP
    Jun 23, 2022

    By mistake I marked my Answer as solution thinking it is yours 🙂 but I do not see unmark option and F5 may consider adding such.

     

    Edit:

     

    Fixed it, I saw the option.