KQL Regex List
Regex Examples
Query
let RegexTest = @'\W*((?i)Admin(?-i))\W*';
let DataSet = materialize (range numbers from 1 to 10 step 1);
DataSet
| extend StringTest = iff(numbers % 2 == 0, 'Admin', 'User') // Change Admin to a string that should match the RegexTest, change User to a string that should not match the RegexTest
| where StringTest matches regex RegexTestAbout this query
Explanation
This document provides a quick reference guide for using regular expressions (regex) in Kusto Query Language (KQL) queries. These regex patterns can be used in detection rules to identify specific patterns in data. Here's a simple breakdown of the key components:
-
Testing Regex: A sample query is provided to test regex patterns. It checks if a string matches a pattern for the word "Admin" (case insensitive).
-
IP Address Regex: A pattern to match IPv4 addresses, which are sequences of four numbers separated by dots.
-
Subnet Regex: A pattern to match IPv4 subnets, which include an IP address followed by a slash and a number.
-
Domain Regex: A pattern to match domain names, which consist of alphanumeric characters and dots.
-
File Extension Regex: A pattern to match file extensions, which are sequences of letters following a dot.
-
String Search Regex: A pattern to search for specific strings like "Domain Admins" in a case-insensitive manner.
-
Regex Parse Functionality: A pattern to extract text between specific strings, such as extracting a file path from a JSON-like structure.
-
Regex Between Two Strings: A pattern to find text between two specified strings.
-
Regex Between Last Char and String: A pattern to find text between the last occurrence of a character and a specified string.
-
Regex Capture Everything After Char/String: Patterns to capture everything after the last occurrence of a character or a specified string.
-
Regex Between Word and Special Char: A pattern to find text between a word and a special character.
-
Regex Between Two Forward Slashes: A pattern to find text between two forward slashes.
-
File Hash Regex: A pattern to match MD5 file hashes, which are 32-character hexadecimal strings.
-
Azure ID Regex: A pattern to match Azure IDs, which are UUIDs formatted as a sequence of hexadecimal characters separated by dashes.
Each section includes example queries or references to example queries that demonstrate how to use these regex patterns in practice.
Details
Bert-Jan Pals
Released: December 23, 2024
Tables
Keywords
Operators