Enterprise Recon 2.11.1

Download ER 2.11.1 User Guide (PDF)

Add Custom Data Type

PII PRO This feature is only available in Enterprise Recon PII and Enterprise Recon Pro Editions. To find out more about upgrading your ER2 license, please contact Ground Labs Licensing. See Subscription License for more information.

A Global Admin or Data Type Author can create custom data types to scan for data types that do not come with ER2.

To build a custom data type:

  1. On the Scans > Data Type Profile page, click on the Custom Data tab.
  2. Click + Add Custom Data Type.

  3. In the Add Custom Data Type dialog box, fill in these fields:

    Field Description
    Describe Your Data Type Enter a descriptive label for your custom data type.
    Add Rules You can add these rules: Phrase, Character and Predefined.
    For details, see Custom Rules and Expressions.
    Advanced Options Ignore duplicates: Flags the first instance of this data type in each match location as match.
    Minimum match count: Flags the match location as a match if there is a minimum number of matches for this custom data type.

Custom Rules and Expressions

You can add custom rules with the Add Custom Data Type dialog box with either the Visual Editor or the Expression Editor. Both editors use the same Expression Syntax.

Visual Editor

Add Custom Data Type visual editor dialog box.

Rules added to the visual editor are resolved from top to bottom i.e. the top-most rule applies, followed by the rule that comes under it until the bottom-most rule is reached.

Example of top to bottom resolve rules for custom data type visual editor.

Expression Editor

To use the expression editor, click View rules as expression on the Visual Editor.
"View rules as expression" option to open up the Expression Editor dialog box.

In the Expression Editor, your custom rules are written as a search expression used by ER2.
Example of a written search expression in the expression editor dialog box.

Expression Syntax

You can add the following custom expression rules to your custom data type:

Phrase

Adding a Phrase rule to your custom data type allows you to search for a specific phrase or string of characters.

A single \ (backslash) character in a Phrase rule generates an error; you must escape the backslash character with an additional backslash to add it to a Phrase, i.e. \\.
Example of a Phrase rule to search for a backslash character.

Character

The Character rule adds a character to your search string and behaves like a wild card character (*). Wild card characters can search for strings containing characters that meet certain parameters.

You can pick the following options to add as character search rules:

Character Match
Space Any white-space character.
Horizontal space Tab characters and all Unicode "space separator" characters.
Vertical space All Unicode "line break" characters.
Any Wildcard character that will match any character.
Alphanumeric ASCII numerical characters and letters.
Alphabet ASCII alphabet characters.
Digit ASCII numerical characters.
Printable Any printable character.
Printable ASCII only Any printable ASCII character, including horizontal and vertical white-space characters.
Printable non-alphabet Printable ASCII characters, excluding alphabet characters and including horizontal and vertical white-space characters.
Printable non-alphanumeric Printable ASCII characters, excluding alphanumeric characters and including horizontal and vertical white-space characters.
Graphic Any ASCII character that is not white-space or control character.
Same line Any printable ASCII character, including horizontal white-space characters but excluding vertical white-space characters.
Non-alphanumeric Symbols that are neither a number nor a letter; e.g. apostrophes ‘, parentheses (), brackets [], hyphens -, periods ., and commas ,.
Non-alphabet Any non-alphabet characters; e.g. ~ ` ! @ # $ % ^ & * ( ) _ - + = { } | [ ] : ; " ' < > ? / , . 1 2 3 …
Non-digit Any non-numerical character.

Predefined

Search rules that are built into ER2. These rules are also used by built-in Data Type Profiles.