Network Intrusion Analysis · Topic 7 of 7

Basic Regular Expressions

Learn to read basic regular expressions, including character classes, quantifiers, anchors, groups and escapes, and how analysts use them to search logs.

4 min

In a nutshell

A regex is a pattern that describes a set of text strings.
A dot matches any one character, and \. matches a real dot.
* means zero or more, + means one or more and ? means zero or one.

What it is

A regular expression, or regex, is a compact pattern that describes a set of text strings.

Analysts use regexes to search logs, write detection rules and filter data. One pattern can find every failed login, every IP address or every request for an executable file.

You do not need to write complex patterns. You need to read a simple one and say what it matches.

How it works

A regex is built from literal characters and a small set of special symbols.

The building blocks

Symbol	Meaning	Example	Matches
Literal text	The exact characters	`login`	The word login
`.`	Any single character	`a.c`	abc, a1c, a-c
`*`	Zero or more of the previous item	`ab*c`	ac, abc, abbc
`+`	One or more of the previous item	`ab+c`	abc, abbc, not ac
`?`	Zero or one of the previous item	`colou?r`	color, colour
`^`	Start of the line	`^GET`	Lines that begin with GET
`$`	End of the line	`\.exe$`	Lines that end in .exe
`[abc]`	Any one of the listed characters	`gr[ae]y`	gray, grey
`[0-9]`	Any one character in the range	`port [0-9]`	port 5
`\d`	A digit, in tools that support it	`\d\d`	42
`{n}` and `{n,m}`	Exactly n, or n to m, repeats	`[0-9]{1,3}`	1 to 3 digits
`( )`	A group	`(ab)+`	ab, abab
`\`	Escape a special symbol	`\.`	A real dot

The vertical bar means either one or the other. For example, cat|dog matches cat or dog.

The dot is special, so a real dot must be escaped with a backslash. The pattern 10.1.1.5 also matches 10x1y1z5, whereas 10\.1\.1\.5 matches only the address.

Reading examples

Read a pattern from left to right, one piece at a time.

^GET .*\.exe matches a line that starts with GET, followed by anything, and then .exe. It finds requests for executable files.
[0-9]{1,3}(\.[0-9]{1,3}){3} matches an IPv4 shaped address, such as 10.1.1.25. It is one to three digits, then three groups of a dot and one to three digits.
Failed password for (root|admin) matches failed logins for the root or the admin account.
^4625 matches lines that start with that event ID.
\.(exe|dll|scr)$ matches lines ending with one of three file extensions.

This address pattern matches things such as 999.999.999.999, which is not a real address. A regex checks the shape of text, not its meaning.

Using regexes in practice

The command line tool grep applies a pattern to a file. The -E option enables extended patterns, which include +, ?, | and {n,m}.

$ grep -E "Failed password for (root|admin)" /var/log/auth.log
$ grep -E "\.(exe|dll)$" proxy.log
$ grep -c "Failed password" /var/log/auth.log

The first command lists failed logins for two accounts. The second lists lines that end in two file types. The -c option in the third counts matching lines instead of printing them.

Regexes also appear in SIEM searches, IDS rules and Wireshark or log filters. The exact syntax differs slightly between tools, but the basic symbols are shared.

Common pitfalls when reading a pattern

A pattern without anchors matches anywhere in the line.
Greedy symbols such as .* match as much as they can, so a pattern may match more than you expect.
Case matters in many tools unless a case insensitive option is set.
Special characters need an escape, such as \. for a dot.

What to remember for the exam

Seven facts cover most questions on this topic.

A regex is a pattern that describes a set of text strings.
A dot matches any one character, and \. matches a real dot.
* means zero or more, + means one or more and ? means zero or one.
^ anchors the start of a line and $ anchors the end.
Square brackets match one character from a set or range.
{n,m} sets a minimum and maximum number of repeats.
Parentheses make groups, and the bar means either one or the other.

Exam tip

Read a regex piece by piece, left to right, and say each piece in words before you look at the answers.

Common mistakes

These four errors appear often.

Forgetting to escape the dot. An unescaped dot matches any character.

Confusing * and +. A star allows zero matches, and a plus needs at least one.

Forgetting anchors. Without ^ or $, the pattern can match in the middle of a line.

Assuming a matching shape is a valid value. The IP address pattern also matches numbers above 255.

Watch out

A greedy pattern such as .* can match far more text than you intended, so test it on sample lines.

Check yourself

Work through these three questions.

What does the pattern \.exe$ match?
It matches lines that end in .exe, because the backslash makes the dot a real dot and the dollar sign anchors the end.
How does + differ from *?
Plus needs one or more of the previous item, and star allows zero or more.
What does [0-9]{1,3} match?
One to three digits in a row.

Topic 7 of 7 in Network Intrusion Analysis

Test yourself on Network Intrusion Analysis

The full Cisco CCNA 200-201 CBROPS question bank has 754 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.