2016-08-21 03:44 PM
I am trying to create a regex to filter urls but it is not working. I am trying to apply the following regex:
/\w{20}\./g
This is to show urls that have 20 alphanumeric characters before the ".", i.e. trying to find long urls in a hope to identify DGA created urls. However it is not working when I put it as a search criteria.
I have run tests with lower numbers to test it but it still returns no results even when it should. Please help to determine why it is not working.
2016-08-21 06:42 PM
Hello All
I managed to find the answer. In case anyone is interested, SA uses the Perl regex syntax.
You have to enter the regex without the "/.../" slashes. The regex that helped me in the end was:
\/\/[^w][a-z0-9]{13}
This will hit on something like the following (bold):
http://turnaroundfitness.com/3-simp
2016-08-21 06:42 PM
Hello All
I managed to find the answer. In case anyone is interested, SA uses the Perl regex syntax.
You have to enter the regex without the "/.../" slashes. The regex that helped me in the end was:
\/\/[^w][a-z0-9]{13}
This will hit on something like the following (bold):
http://turnaroundfitness.com/3-simp