Defining Custom Detection Rules

Security for Jira allows for creation of custom scanning rules using regular expressions.

Only Jira Administrators can access these settings.

To create a rule, first visit the Settings page, and then expand the “Custom rules” section.

Security for Jira imposes hard limits on how much memory a rule can use and how long a rule can take to scan an issue fragment. Scanning rules which exceed these limits will be automatically disabled, and the scan will be marked as failed.

Developing custom rules

Our application uses the built-in JDK java regex library (Java 8). The supported regex constructs are documented here.

The tool we recommend for testing out new custom rules is https://regex101.com.

Make sure to select “Java 8” as the “Flavor”:

Example custom rules

Bitcoin Address

^[13][a-km-zA-HJ-NP-Z0-9]{26,33}$	

Youtube Links

<a\s+(?:[^>]*)href=\"((?:https|http):\/\/\w{0,3}.youtube+\.\w{2,3}\/watch\?v=[\w-]{11})">(?:.*?)<\/a>