# 12.2.2.9 Lab – Regular Expression Tutorial

Rate this post

#### Objectives

In this lab, you will learn how to use regular expressions to search for desired strings of information.

#### Background / Scenario

A regular expression (regex) is a pattern of symbols that describes data to be matched in a query or other operation. Regular expressions are constructed similarly to arithmetic expressions, by using various operators to combine smaller expressions. There are two major standards of regular expression, POSIX and Perl.

In this lab, you will use an online tutorial to explore regular expressions. You will also describe the information that matches given regular expressions.

#### Required Resources

• CyberOps Workstation VM
• Internet connection

#### Step 1: Complete the regexone.com tutorial.

a. Open a web browser and navigate to https://regexone.com/. Regex One is a tutorial that provides you with lessons to learn about regular expression patterns.

b. After you have finished with the tutorial, record the function of some of the metacharacters that are used in regular expressions.

Metacharacters Description
\$
*
.
[ ]
\.
\d
\D
^
{m}
{n,m}
\$
*
abc|123

#### Step 2: Describe the provided regular expression pattern.

Regex pattern Description
^83
[A-Z]{2,4}
2015
05:22:2[0-9]
\.com
complete|GET
0{4}

In this step, you will verify your answers in the previous step using a text file stored in the CyberOps Workstation VM.

b. Open a terminal and navigate to the following folder:

`[analyst@secOps ~]\$ cd lab.support.files/`

c. Use the less command to open the logstash-tutorial.log file.

`[analyst@secOps lab.support.files]\$ less logstash-tutorial.log`

d. At the bottom of the screen, you will see logstash-tutorial.log: highlighted. This is the cursor at which you will enter the regular expression. Precede the regular expression with a forward slash (/). For example, the first pattern in the above table is ^83. Enter /^83.

The matching text from the log file is highlighted. Use the scroll wheel on the mouse or use the j or k keys on your keyboard to locate the highlighted patterns.

e. For the next expression, enter /[A-Z]{2,4} at the colon (:) prompt.

Note: The colon is replaced by / as you type the expression.

f. Enter the rest of the regular expressions from the table in Step 2. Make sure all the expressions are preceded with a forward slash (/). Continue until you have verified your answers. Press q to exit the logstash-tutorial.log file.

g. Close the terminal and shut down the VM.