Common wildcard patterns and their behavior

This article describes the impact of using wildcards in scans (set via scan options when configuring the scan) and the behavior of wildcard scans.

In Spirion Sensitive Data Platform (SDP) (and the underlying scanning engine), selecting “Include” with a wildcard (for example, * or ?) in the path filtering options explicitly restricts the scan scope to only the directories, subdirectories, or files that match that wildcard pattern.

Any items or paths that do not match the pattern are bypassed during discovery and are not queued for content inspection.

How the Scanning Pipeline Processes Wildcard "Include" Paths

  1. Discovery Agent Filtering:
    • When the Discovery Agent enumerates the target filesystem, cloud bucket, or file share, it evaluates each encountered path/item against the include pattern.
    • Only matching paths and items are written as Pending rows into the local PostgreSQL work queue (search_queue_<scanId>).
    • All non-matching paths are discarded upfront, reducing scan overhead and queue size.
  3. Search Worker Processing:
    • The Search Agents only pull and inspect files that met the inclusion criteria during the discovery phase.
  5. Precedence with "Exclude" Rules:
    • If both Include and Exclude rules are configured, Exclude rules take precedence.
    • A file matching an Include wildcard rule is skipped if it also matches an Exclude wildcard rule.

Common Wildcard Patterns & Their Behavior

Pattern Example

Wildcard Scope

Resulting Scan Behavior

C:\Users\*\Documents\

Directory Wildcard

Scans the Documents folder across all user profiles on the endpoint (for example, C:\Users\jdoe\Documents\, C:\Users\asmith\Documents\), skipping all other folders under C:\Users\.

\\server\share\*\Finance\

Multi-Department Wildcard

Scans any subdirectory matching Finance across various branch/division shares (for example, ...\NY\Finance\, ...\LON\Finance\).

Best Practices & Operational Gotchas

  • Trailing Slashes on Folders:
    • If you intend to include an entire directory tree using a wildcard, ensure proper folder syntax.
      • For example, C:\Projects\*\ vs C:\Projects\*
    • Be sure to include the trailing backslash character: \
    • Omitting the trailing backslash character \ may cause the engine to match only files named * instead of enumerating subfolder contents.
  • Over-Restricting Scope:
    • Because "Include" acts as a whitelist filter, any file or folder outside the wildcard pattern is ignored.
    • If you only want to skip specific known directories (like C:\Windows\ or node_modules\), it is usually safer to use Exclude rules instead of broad Include rules.
  • Performance Benefit:
    • Using targeted "Include" wildcards significantly speeds up scan duration and reduces Agent CPU/disk I/O by preventing the engine from opening and parsing irrelevant files.


Was this article helpful?

Powered by Product Fruits