> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/workflows/define-workflow-settings/action-settings/query/regex-scan.md). # Regex scan Regex (regular expression) is a string or pattern sequence of symbols and characters that is searched for in documents. Regular expressions provide a powerful and flexible way to match all characters or portions of text in a string. With the Regex scan action, you can scan for customized patterns that are specific to your organization, such as customer data and sensitive company information, with maximum flexibility. #### What does a Regex scan look for and what does it return? A Regex scan uses a deterministic scanning algorithm to detect a specific expression, string or pattern in a file. If you accurately configure a regular expression, the regex scan will find any relevant results in the file and display them in the step output. #### **When to use a Regex scan?** We recommend you use a Regex scan when you know the textual structure, or pattern, of the keywords you are looking for and would like to view clear, unequivocal results. Alternatively, use a Regex scan when you're looking for proprietary sensitive information that is not considered as personally identifiable information (PII). This could include sensitive internal company items, budget data, or unique customer data. {% hint style="success" %} * We recommend you use this [testing site]() to build and test regular expressions on sample content. If the expression returns content, the expression is valid. * For best practices on how to set up a regex scan, see [DoControl videos](/docontrol-user-guide/help/videos.md#regex-scan). {% endhint %} ## Use cases Common use cases for running a regex scan include references to salary, internal documents, executives in the company, or specific confidential topics. An example of a regex string is: `(\W|^)[\w.-]{0,25}@(yahoo|hotmail|gmail).com(\W|$)` The results should return any email address match from these domains: yahoo.com, hotmail.com, and gmail.com, such as johndoe\@gmail, . A regex example to match any email address from a specific domain can be found [here](). ## Supported file types You can scan text-based files for regex patterns in these apps: * [Google](#google-regex-scan) * [Slack](#slack-regex-scan) * [Slack Enterprise](#slack-enterprise-regex-scan) DoControl supports these files types when running a Regex scan query:
AppFile typeMIME type
General
  • TXT (text)
  • CSV (comma separated values)
  • TSV (tab separated values)
  • PDF (portable document format)

  • text/plain
  • text/csv
  • text/tab-separated-values
  • application/pdf
Google Drive
  • GDOC (Google Docs)
  • GSLIDES (Google Slides)
  • GSHEET (Google Sheets)

  • application/vnd.google-apps.document
  • application/vnd.google-apps.presentation
  • application/vnd.google-apps.spreadsheet
Microsoft
  • DOCX (Word version 2007 and up)
  • XLS (Excel up to version 2003)
  • XLSX (Excel version 2007 and up), XLT
  • PPTX (Powerpoint version 2007 and up)

  • application/vnd.ms-excel
  • application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
  • application/vnd.openxmlformats-officedocument.wordprocessingml.document
  • application/vnd.openxmlformats-officedocument.presentationml.presentation
## Google regex scan You can define a workflow with a regex scan to detect [keywords or patterns](#regex-patterns) across all Google Drive assets. If a regex pattern is found, your organization will be notified, and can remediate accordingly. {% hint style="info" %} Before you run a regex scan for the first time, make sure you enable PII access in **Settings > Admin > Legal consent**. For more information, see [Legal consent for PII.](/docontrol-user-guide/system-management/settings/legal-consent-for-pii.md) {% endhint %}

Defining a workflow with a regex scan

1. For the **App**, select Google Drive. 2. Select the relevant trigger. 3. From the Actions pane, select **Query > Regex scan,** drag it to the canvas and connect it to the trigger. 4. Click the **Regex scan** action to open its settings: * **Asset ID** - This field is automatically populated * **Lexical list or patterns** - Select a lexical list or [regex pattern](#regex-patterns) from the dropdown or insert a regular expression that you wish to scan for. You can insert multiple patterns. * **Error handling -** Choose the relevant option: * Break on failure and warning errors * Break on failure error only * Continue workflow
5. Select **Flow control > Conditional** to add a conditional step to determine if the asset contains the regex expression, using the `Has regex matches` macro. * If **False** - Add an **End workflow** step. * If **True -** Add a relevant remediation action, such as **Remove collaborator**. {% hint style="success" %} To extract the results of the regex matches, you can use several predefined macros in any following action step: * **Regex matches** - list of all matches found * **Regex matches with index** - list of matches with the corresponding index in document * **Has regex matches** - True or false, depending if any matches are found. {% endhint %} 7. If the regex expression is found, select **Notify > in Slack** or **by email** to send an automatic notification. ## Slack regex scan You can define a workflow with a regex scan to detect [keywords or patterns](#regex-patterns) in a file that's shared in an external Slack channel. If a regex pattern is found, your organization will be notified, and can remediate accordingly. {% hint style="info" %} Before you run a regex scan for the first time, make sure you enable PII access in **Settings > Admin > Legal consent**. For more information, see [Legal consent for PII.](/docontrol-user-guide/system-management/settings/legal-consent-for-pii.md) {% endhint %}
1. For the **App**, select Slack. 2. Select the relevant trigger, for example, User shared sensitive files in external channels. 3. The trigger conditions are automatically populated: * **Asset type supports file scanning** - File type supports regex scanning. * **Channel is public** - Slack channel is shared. 4. From the Actions pane, select **Query > Regex scan,** drag it to the canvas and connect it to the trigger. Click the action to open its settings. * **Asset ID** - This field is automatically populated * **Lexical list or patterns** - Select a lexical list or [regex pattern](#regex-patterns) from the dropdown or insert a regular expression that you wish to scan for. You can insert multiple patterns. * For **Error handling**, choose the relevant option. 5. Select **Flow control > Conditional** to add a conditional step to determine if the file contains the regex expression, using the `Has regex matches` macro. * If **False** - Add an **End workflow** step. * If **True -** Add a **Delete** action to remove the shared file. {% hint style="success" %} To extract the results of the regex matches, you can use several predefined macros in any following action step: * **Regex matches** - list of all matches found * **Regex matches with index** - list of matches with the corresponding index in document * **Has regex matches** - True or false, depending if any matches are found. {% endhint %} ## Slack Enterprise regex scan You can define a workflow with a regex scan to detect [keywords or patterns](#regex-patterns) in files and messages sent in a public Slack Enterprise channel. If a regex pattern is found, your organization will be notified, and can remediate accordingly.

Defining a workflow with a regex scan for Slack Enterprise files or messages

1. For the **App**, select Slack Enterprise. 2. Select the relevant trigger, for example, User shared sensitive messages in public channels. 3. From the Actions pane, select **Query > Regex scan,** drag it to the canvas and connect it to the trigger. Click the action to open its settings. * **Scan entity** - Select the Slack entity to scan: Message or file (or both). * **Lexical list or patterns** - Select a lexical list or [regex pattern](#regex-patterns) from the dropdown or insert a regular expression that you wish to scan for. You can insert multiple patterns. * For **Error handling**, choose the relevant option. 4. Select **Flow control > Conditional** to add a conditional step to determine if the message contains the regex expression, using the `Has regex matches` macro. * If **False** - Add an **End workflow** step. * If **True -** Add a **Delete message** action to remove the shared message. {% hint style="success" %} To extract the results of the regex matches, you can use several predefined macros in any following action step: * **Regex matches** - list of all matches found * **Regex matches with index** - list of matches with the corresponding index in document * **Has regex matches** - True or false, depending if any matches are found. {% endhint %} ## Output of regex scan To view the results of your regex scan, go to the specific workflow and view its execution details. **For example**: If the regex expression `"^test*\n"` is scanned and found in the file contents, it returns this result:\ Matches: `[["index:4", "match: test run"], ["index:100", "testing"]]` This means the strings were found at character number 4 and 100 in the file contents.

Output of regex scan

## Regex patterns You can use any of these predefined regex patterns in your regex scan:
Regex patternDescription
Social security numberUS social security number
Credit CardCredit card number
Swift NumberInternational bank code that identifies particular banks worldwide. It's also known as a Bank Identifier Code (BIC)
IBANInternational Bank Account Number (IBAN) is an internationally agreed-upon system of identifying bank accounts across national borders to facilitate the communication and processing of cross-border transactions with a reduced risk.
Medicare Beneficiary Identifier (MBI)The Medicare Beneficiary Identifier (MBI) is a randomly generated identifier used to identify all Medicare beneficiaries. It replaced the previously-used SSN-based Medicare HIC Number (HICN).
US Medicare Health Insurance Claim (HIC)Medicare Health Insurance Claim # (HIC) is a unique identifier of a beneficiary used for Medicare entitlement and billing purposes.
AWS access keyAWS access keys to make programmatic calls to Amazon Web Services
AWS secret keyAWS secret keys to make programmatic calls to Amazon Web Services
Google API keyGoogle keys to make programmatic calls to Google API
RSA private keyRSA is a public-key cryptosystem that is widely used for secure data transmission
Cryptographic private keyPrivate encryption key containing a private key reference
GitHub referenceReference to a GitHub repository
EmailEmail addresses
URLLinks and URL structural references
## Regex syntax limitations When using syntax in the regex scan, be aware of these limitations. * DoControl uses [RE2 syntax ](https://cran.r-project.org/web/packages/re2/vignettes/re2_syntax.html)for regular expressions. * You must enter at least five characters in the regex expression; otherwise it might return too many results * You can enter up to 1000 characters in the regex expression. * The file size is limited to 10MB. * If the result is greater than 70 characters, the `Expression too wide` error is returned. * If it takes more than two minutes to run the regex scan, the `Expression too wide` error is returned. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/workflows/define-workflow-settings/action-settings/query/regex-scan.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.