How do I best add a GUID as a data type?

Option 1: Use a Keyword (For a Specific GUID)

If you are looking for one specific, known GUID (for example, 550e8400-e29b-41d4-a716-446655440000), use the Keyword data type.

1. From the left side navigation menu navigate to Settings > Global Data Types.
2. Click the CUSTOM DATA TYPES tab on the top of the page.
3. Click the blue "Actions" button and select Add Custom Data Type from the drop-down menu.
4. Under "Select Data Type" select Keyword.
5. Name: Give it a descriptive name (for example, "Specific Project GUID").
6. Keyword: Paste the exact GUID string.

Note: Keywords in Spirion are typically case-sensitive. Ensure the GUID in your search matches the casing (uppercase vs. lowercase) expected in your files.

Option 2: Use a Regular Expression (For Any GUID)

If you want to find any string that follows the standard GUID pattern (8-4-4-4-12 hexadecimal characters), use a Regular Expression (RegEx).

This is the most common way to find GUIDs because they follow a predictable structure:

1. From the left side navigation menu navigate to Settings > Global Data Types.
2. Click the CUSTOM DATA TYPES tab on the top of the page.
3. Click the blue "Actions" button and select Add Custom Data Type from the drop-down menu.
4. Under "Select Data Type" select Regular Expression.
5. 1. Name: "GUID Pattern".
   2. Regex: Use a pattern that matches the standard GUID format.
5. Common example:
6. 1. To avoid matching random strings of characters, you may want to add word boundaries (\b) to the start and end:

   \b[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}\b

Which one should you choose?

• Use Keyword if you are searching for a specific "secret" or identifier that you already know.
• Use RegEx if you are trying to identify files that contain any unique identifiers, which is often a sign of database exports or system logs.

Important Considerations

• Case Sensitivity:
• • GUIDs are often represented in all-caps or all-lowercase.
  • RegEx is generally case-insensitive in Spirion by default, but Keywords are not.
• Braces:
• • Some GUIDs are wrapped in curly braces (for example, {550e8400-...}).
  • If your data includes these, ensure your Keyword includes them or update your Regular Expression to account for optional braces: \{?[a-fA-F0-9]{8}-...\}?.
• Performance:
• • If you have a list of 100+ specific GUIDs to find, do not create 100 Keywords.
  • Instead, use a Dictionary data type and upload the list as a text file.