regex101: Python Match Workspace

1st Alternativenot $?\s*1 of \s*([\w\*]*)\s*$?

not the literal text not (case sensitive)

\(?optionally matches the literal ( (40₁₀ / 50₈ / 28₁₆)

\s*a Unicode whitespace character, repeated any number of times

1 of the literal text 1 of (case sensitive)

\s*a Unicode whitespace character, repeated any number of times

Group 1([\w\*]*)

Character Class[\w\*]*

*matches any number of characters from the set below:

\wa Unicode word character

\*the literal * (42₁₀ / 52₈ / 2A₁₆)

\s*a Unicode whitespace character, repeated any number of times

\)?optionally matches the literal ) (41₁₀ / 51₈ / 29₁₆)

2nd Alternativenot $?\s*all of \s*([\w\*]*)\s*$?

not the literal text not (case sensitive)

\(?optionally matches the literal ( (40₁₀ / 50₈ / 28₁₆)

\s*a Unicode whitespace character, repeated any number of times

all of the literal text all of (case sensitive)

\s*a Unicode whitespace character, repeated any number of times

Group 2([\w\*]*)

Character Class[\w\*]*

*matches any number of characters from the set below:

\wa Unicode word character

\*the literal * (42₁₀ / 52₈ / 2A₁₆)

\s*a Unicode whitespace character, repeated any number of times

\)?optionally matches the literal ) (41₁₀ / 51₈ / 29₁₆)

3rd Alternativenot \s*([^\d\(][^\(\s]*)

not the literal text not (case sensitive)

\s*a Unicode whitespace character, repeated any number of times

Group 3([^\d\(][^\(\s]*)

Negated Character Class[^\d\(]

\da Unicode decimal digit

\(the literal ( (40₁₀ / 50₈ / 28₁₆)

Negated Character Class[^\(\s]*

*matches any number of characters outside the set below:

\(the literal ( (40₁₀ / 50₈ / 28₁₆)

\sa Unicode whitespace character

4th Alternativenot $\s*([^\d]+.*)\s?$

not the literal text not (case sensitive)

\(the literal ( (40₁₀ / 50₈ / 28₁₆)

\s*a Unicode whitespace character, repeated any number of times

Group 4([^\d]+.*)

Negated Character Class[^\d]+

+matches at least one character outside the set below:

\da Unicode decimal digit

.*any Unicode character (except for line terminators), repeated any number of times

\s?optionally matches a Unicode whitespace character

\)the literal ) (41₁₀ / 51₈ / 29₁₆)

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

25 tokens

Regular Expression

not \(?\s*1 of \s*([\w\*]*)\s*\)?|not \(?\s*all of \s*([\w\*]*)\s*\)?|not \s*([^\d\(][^\(\s]*)|not \(\s*([^\d]+.*)\s?\)

New

( passwordchanged and not passwordchanged_filter ) | near samrpipe
( selection_cammute and not   filter_cammute ) or ( selection_chrome_frame and not filter_chrome_frame ) or ( selection_devemu and not filter_devemu ) or ( selection_gadget and not filter_gadget ) or ( selection_hcc and not filter_hcc ) or ( selection_hkcmd and not filter_hkcmd ) or ( selection_mc and not filter_mc ) or ( selection_msmpeng and not          filter_msmpeng ) or ( selection_msseces and not filter_msseces ) or ( selection_oinfo and not 	  filter_oinfo ) or ( selection_oleview and not filter_oleview ) or ( selection_rc and not filter_rc )
(exec_selection and not exec_exclusion) or (create_selection and create_keywords)
(selection1 and not     filter1) or selection2 or selection3 or selection4
all of selection and not (1 of   exclusion_*)
keywords and not 1 of     filters
methregistry or ( methprocess and not      filterprocess )
selection and not ( filter1 or filter2 )
selection and not ( filter1 or filter2 or filter3 )
selection and not (ini or intel)
selection and not 1 of       falsepositive*
selection and not (1 of    falsepositive*)
selection and not exclusion
selection and not falsepositive
selection and not     falsepositives
selection and not filter
selection and not reduction
selection1 and not selection2
selection1 or ( selection2 and    not     filter2 )
selection_registry and not exclusion_images
selector | near dllload1 and dllload2 and not    exclusion
selection and not (filter1)
selection and not all of      falsepositive*
selection and not (all of   falsepositive*)
selection and selection2
selection or (selection2 and selection3)
selection or 1 of selection*