KQL Regex List
Regex Examples
Query
let MISPFeed = externaldata(Subnet: string)[@"https://raw.githubusercontent.com/ktsaou/blocklist-ipsets/master/firehol_level1.netset"] with (format="txt", ignoreFirstRecord=True);
let IPv4SubnetRegex = '[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}/[0-9]{1,3}';
let x = MISPFeed
| where Subnet matches regex IPv4SubnetRegex
| distinct Subnet;
xAbout this query
Explanation
This document provides a quick reference guide for using regular expressions (regex) in Kusto Query Language (KQL) queries. These regex patterns can be used in detection rules to identify specific patterns in data. Here's a simple breakdown of the key components:
-
Testing Regex: A sample query is provided to test regex patterns. It checks if a string matches a pattern for the word "Admin" (case insensitive).
-
IP Address Regex: A pattern to match IPv4 addresses, which are sequences of four numbers separated by dots.
-
Subnet Regex: A pattern to match IPv4 subnets, which include an IP address followed by a slash and a number.
-
Domain Regex: A pattern to match domain names, which consist of alphanumeric characters and dots.
-
File Extension Regex: A pattern to match file extensions, which are sequences of letters following a dot.
-
String Search Regex: A pattern to search for specific strings like "Domain Admins" in a case-insensitive manner.
-
Regex Parse Functionality: A pattern to extract text between specific strings, such as extracting a file path from a JSON-like structure.
-
Regex Between Two Strings: A pattern to find text between two specified strings.
-
Regex Between Last Char and String: A pattern to find text between the last occurrence of a character and a specified string.
-
Regex Capture Everything After Char/String: Patterns to capture everything after the last occurrence of a character or a specified string.
-
Regex Between Word and Special Char: A pattern to find text between a word and a special character.
-
Regex Between Two Forward Slashes: A pattern to find text between two forward slashes.
-
File Hash Regex: A pattern to match MD5 file hashes, which are 32-character hexadecimal strings.
-
Azure ID Regex: A pattern to match Azure IDs, which are UUIDs formatted as a sequence of hexadecimal characters separated by dashes.
Each section includes example queries or references to example queries that demonstrate how to use these regex patterns in practice.
Details
Bert-Jan Pals
Released: December 23, 2024
Tables
Keywords
Operators