Question on parsing by regular expression in Pattern Designer

Tate Roth
Tera Contributor

I am working on discovering all certs on Windows servers (Linux to come) to check for any expiring within X amount of days.  I received the suggestion to try using the pattern designer as I was having issues using Probes and Sensors.  I added a step to the Windows OS - Servers discovery pattern with the operation of Parse Command Output.  I have a powershell command that returns all the info I want, but it's kinda messy.  I'm trying to use a regular expression to parse the output but am having some difficulty.  On the docs site, it states that since there is only one Regular Expression field, you simply combine the expressions by wrapping each in parenthesis, the order of which needs to correspond with the order of the variable you have created and they will link up.  The issue I am having is I get an error whenever I try to do that.  To keep it simple I'm starting with 2 variables as shown below.

find_real_file.png

Here you can see my two expressions wrapped and following each other.  If I click on Test I get the message "Operation executed with no change to the debug session (Note: This could be due to the operation returning empty results or failed precondition)"

Someone suggested I use an * between them in this manner ((?<=Thumbprint   : )(?s)(.*$))*((?<=FriendlyName : )(?s)(.*$)).  Then I get the message "Failed to parse content due to the following error: INVALID_REGEX length: 2".

So I tried to wrap all of that in parenthesis(((?<=Thumbprint   : )(?s)(.*$))*((?<=FriendlyName : )(?s)(.*$))) at which point it highlights only the information behind FriendlyName as if it was the first variable on the output section but when I click on Test, I get the same error "Failed to parse content due to the following error: INVALID_REGEX length: 2".

Does anyone know if there is some other character or do I need some other operator to make this work?

8 REPLIES 8

Yep so what you should do is capture 1,2 into a table and then you can filter on the specific name you want using the filter table operation. This will get you name, value row of only the row you want and then you can just access it with table_name[*].value and assign it to what you want :). Should get you the values you are looking for.

OK, now I feel dumb.  Let me give that a shot.  If I get it to work out, I will mark your response as correct.

Sounds good let me know if you run into any issues while implementing (once you do one it becomes much clearer how to do it in the future).

Hello Tate,

Just following up to see how things went. If things went well please feel free to mark an answer correct and if you ran into any other issues feel free to pass them along on here. Thanks.