Please enable JavaScript to use regex101
/
^
r
e
g
e
x
[
\
-
_
]
?
1
0
1
$
/
i
Reg
ular
Ex
pressions
101
Upgrade to Pro
Enterprise
Regular Expression
/
changed\sfor:\s'+(?<changed_filename>\S+[^'])
/
gm
Input 1
1
New
Apr 17 08:09:45 clap ossec: Alert Level: 7; Rule: 550 - Integrity checksum changed.; Location: clap->syscheck; classification: ossec,syscheck,; Previous MD5: '0a79ed913a931af0220c0349353ab9ec'; Current MD5: '809a2abe99e979b90e9298d3a052a312'; Previous SHA1: '814125fb17df21b9a91f8b1f839dac91733f0150'; Current SHA1: '3728e27f1f9ab27654ebb72aa6d01219d8624881'; Size changed: from '5780' to '5950'; Integrity checksum changed for: '/home/clapuser/UserDisable/disable.py'
Substitution
Apr 17 08:09:45 clap ossec: Alert Level: 7; Rule: 550 - Integrity checksum changed.; Location: clap->syscheck; classification: ossec,syscheck,; Previous MD5: '0a79ed913a931af0220c0349353ab9ec'; Current MD5: '809a2abe99e979b90e9298d3a052a312'; Previous SHA1: '814125fb17df21b9a91f8b1f839dac91733f0150'; Current SHA1: '3728e27f1f9ab27654ebb72aa6d01219d8624881'; Size changed: from '5780' to '5950'; Integrity checksum changed for: '/home/clapuser/UserDisable/disable.py'