200-201 · Question #205
An analyst is using the SIEM platform and must extract a custom property from a Cisco device and capture the phrase, "File: Clean." Which regex must the analyst import?
The correct answer is D. ^File: Clean$. To precisely extract the standalone phrase "File: Clean" from a custom property, the regular expression must anchor the match to the beginning and end of the string.
Question
An analyst is using the SIEM platform and must extract a custom property from a Cisco device and capture the phrase, "File: Clean." Which regex must the analyst import?
Options
- AFile: Clean
- B^Parent File Clean$
- CFile: Clean (.*)
- D^File: Clean$
How the community answered
(32 responses)- A9% (3)
- B3% (1)
- C3% (1)
- D84% (27)
Why each option
To precisely extract the standalone phrase "File: Clean" from a custom property, the regular expression must anchor the match to the beginning and end of the string.
`File: Clean` would match the phrase anywhere within a longer string, which might not isolate the exact property as intended.
`^Parent File Clean$` would attempt to match the string "Parent File Clean" and not the desired "File: Clean".
`File: Clean (.*)` would match "File: Clean" followed by any other characters, capturing more than just the exact phrase.
The regex `^File: Clean$` uses `^` to match the beginning of the string and `$` to match the end, ensuring that the entire string must be exactly "File: Clean" for a successful extraction as a custom property.
Concept tested: Exact string matching with regex anchors
Source: https://learn.microsoft.com/en-us/dotnet/standard/base-types/regular-expression-language-quick-reference#anchors
Topics
Community Discussion
No community discussion yet for this question.