using System;
using System.Text.RegularExpressions;
public class Example
{
public static void Main()
{
string pattern = @"([\r\n]+)(?=[A-Z][a-z]{2}\s+\d{1,2}\s\d{2}:\d{2}:\d{2}\s)";
string input = @"Jun 26 13:46:12 128.23.84.166 [local0.err] <131>Jun 26 13:46:12 GBSDFA1AD011HMA.systems.uk.fed ASM:f5_asm=PROD
vs_name=""/f5-tenant-01/XXXXXXXX""
violations=""HTTP protocol compliance failed""
sub_violations=""HTTP protocol compliance failed:Header name with no header value""
attack_type=""HTTP Parser Attack""
violation_rating=""3/5""
severity=""Error""
support_id=""XXXXXXXXX""
policy_name=""/Common/waf-fed-transparent""
enforcement_action=""none""
dest_ip_port=""128.155.6.2:443""
ip_client=""128.163.192.44""
x_forwarded_for_header_value=""N/A""
method=""POST""
uri=""/auth-service/api/v2/token/refreshAccessToken""
microservice=""N/A""
query_string=""N/A""
response_code=""500""
sig_cves=""N/A""
sig_ids=""N/A""
sig_names={N/A}
sig_set_names=""N/A""
staged_sig_cves=""N/A""
staged_sig_ids=""N/A""
staged_sig_names=""N/A""
staged_sig_set_names=""N/A""
<?xml version='1.0' encoding='UTF-8'?>
<BAD_MSG>
<violation_masks>
<block>0-0-0-0</block>
<alarm>2400500004500-106200000003e-0-0</alarm>
<learn>0-0-0-0</learn>
<staging>0-0-0-0</staging>
</violation_masks>
<request-violations>
<violation>
<viol_index>14</viol_index>
<viol_name>VIOL_HTTP_PROTOCOL</viol_name>
<http_sanity_checks_status>2</http_sanity_checks_status>
<http_sub_violation_status>2</http_sub_violation_status>
<http_sub_violation>SGVhZGVyICdBdXRob3JpemF0aW9uJyBoYXMgbm8gdmFsdWU=</http_sub_violation>
</violation>
</request-violations>
</BAD_MSG>
Jun 26 13:40:31 128.168.189.4 [local0.err] <131>2025-06-26T13:40:31+00:00 nginxplus-nginx-ingress-controller-6498464cd4-k57b5 ASM:attack_type=""Cross Site Scripting (XSS)"",blocking_exception_reason=""N/A"",date_time=""2025-06-26 13:40:31"",dest_port=""443"",ip_client=""128.175.220.223"",is_truncated=""false"",method=""GET"",policy_name=""waf-fed-enforced"",protocol=""HTTPS"",request_status=""blocked"",response_code=""0"",severity=""N/A"",sig_cves=""N/A,N/A,N/A,N/A"",sig_ids=""200001475,200000098,200001088,200101609"",sig_names=""XSS script tag end (Parameter) (2),XSS script tag (Parameter),alert() (Parameter)..."",sig_set_names=""{High Accuracy Signatures;Cross Site Scripting Signatures;Generic Detection Signatures (High Accuracy)},{High Accuracy Signatures;Cross Site Scripting Signatures;Generic Detection Signatures (High Accuracy)},{Cross Site Scripting Signatures}..."",src_port=""64344"",sub_violations=""N/A"",support_id=""11720398659341069199"",threat_campaign_names=""N/A"",unit_hostname=""nginxplus-nginx-ingress-controller-6498464cd4-k57b5"",uri=""/waf"",violation_rating=""5"",vs_name=""14-cyberwasp-sv-helloworld.ikp3001ynp.cloud.uk.fed:24-/waf"",x_forwarded_for_header_value=""N/A"",outcome=""REJECTED"",outcome_reason=""SECURITY_WAF_VIOLATION"",violations=""Attack signature detected"",json_log=""{""id"":""11720398659341069199"",""violations"":[{""enforcementState"":{""isBlocked"":true,""isAlarmed"":true,""isInStaging"":false,""isLearned"":false,""isLikelyFalsePositive"":false,""attackType"":[{""name"":""Cross Site Scripting (XSS)""}]},""violation"":{""name"":""VIOL_ATTACK_SIGNATURE""},""signature"":{""name"":""XSS script tag end (Parameter) (2)"",""signatureId"":200001475,""accuracy"":""high"",""risk"":""high"",""hasCve"":false,""stagingCertificationDatetime"":""1970-01-01T00:00:00Z"",""lastUpdateTime"":""2025-01-08T16:57:22Z""},""snippet"":{""buffer"":""c3ZhbmdhPTxzY3JpcHQ+YWxlcnQoMSk8L3NjcmlwdD4i"",""offset"":8,""length"":7},""policyEntity"":{""parameters"":[{""name"":""*"",""level"":""global"",""type"":""wildcard""}]},""observedEntity"":{""name"":""c3Zhbmdh"",""value"":""PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0PiI="",""location"":""query""}},{""enforcementState"":{""isBlocked"":true,""isAlarmed"":true,""isInStaging"":false,""isLearned"":false,""isLikelyFalsePositive"":false,""attackType"":[{""name"":""Cross Site Scripting (XSS)""}]},""violation"":{""name"":""VIOL_ATTACK_SIGNATURE""},""signature"":{""name"":""XSS script tag (Parameter)"",""signatureId"":200000098,""accuracy"":""high"",""risk"":""high"",""hasCve"":false,""stagingCertificationDatetime"":""1970-01-01T00:00:00Z"",""lastUpdateTime"":""2023-11-02T19:36:54Z""},""snippet"":{""buffer"":""c3ZhbmdhPTxzY3JpcHQ+YWxlcnQoMSk8L3NjcmlwdD4i"",""offset"":7,""length"":7},""policyEntity"":{""parameters"":[{""name"":""*"",""level"":""global"",""type"":""wildcard""}]},""observedEntity"":{""name"":""c3Zhbmdh"",""value"":""PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0PiI="",""location"":""query""}},{""enforcementState"":{""isBlocked"":false,""isAlarmed"":true,""isInStaging"":false,""isLearned"":false,""isLikelyFalsePositive"":false,""attackType"":[{""name"":""Cross Site Scripting (XSS)""}]},""violation"":{""name"":""VIOL_ATTACK_SIGNATURE""},""signature"":{""name"":""alert() (Parameter)"",""signatureId"":200001088,""accuracy"":""low"",""risk"":""medium"",""hasCve"":false,""stagingCertificationDatetime"":""1970-01-01T00:00:00Z"",""lastUpdateTime"":""2025-03-19T14:09:48Z""},""snippet"":{""buffer"":""c3ZhbmdhPTxzY3JpcHQ+YWxlcnQoMSk8L3NjcmlwdD4i"",""offset"":15,""length"":6},""policyEntity"":{""parameters"":[{""name"":""*"",""level"":""global"",""type"":""wildcard""}]},""observedEntity"":{""name"":""c3Zhbmdh"",""value"":""PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0PiI="",""location"":""query""}},{""enforcementState"":{""isBlocked"":true,""isAlarmed"":true,""isInStaging"":false,""isLearned"":false,""isLikelyFalsePositive"":false,""attackType"":[{""name"":""Cross Site Scripting (XSS)""}]},""violation"":{""name"":""VIOL_ATTACK_SIGNATURE""},""signature"":{""name"":""\u003cscript\u003ealert(1);\u003c/script\u003e (Parameter)"",""signatureId"":200101609,""accuracy"":""high"",""risk"":""high"",""hasCve"":false,""stagingCertificationDatetime"":""1970-01-01T00:00:00Z"",""lastUpdateTime"":""2020-04-12T21:41:39Z""},""snippet"":{""buffer"":""c3ZhbmdhPTxzY3JpcHQ+YWxlcnQoMSk8L3NjcmlwdD4i"",""offset"":7,""length"":25},""policyEntity"":{""parameters"":[{""name"":""*"",""level"":""global"",""type"":""wildcard""}]},""observedEntity"":{""name"":""c3Zhbmdh"",""value"":""PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0PiI="",""location"":""query""}}],""enforcementAction"":""block"",""method"":""GET"",""clientPort"":64344,""clientIp"":""128.175.220.223"",""host"":""nginxplus-nginx-ingress-controller-6498464cd4-k57b5"",""responseCode"":0,""serverIp"":""0.0.0.0"",""serverPort"":443,""requestStatus"":""blocked"",""url"":""L3dhZg=="",""virtualServerName"":""14-cyberwasp-sv-helloworld.ikp3001ynp.cloud.uk.fed:24-/waf"",""geolocationCountryCode"":""US"",""enforcementState"":{""isBlocked"":true,""isAlarmed"":true,""rating"":5,""attackType"":[{""name"":""Cross Site Scripting (XSS)""}],""ratingIncludingViolationsInStaging"":5,""stagingCertificationDatetime"":""1970-01-01T00:00:00Z""},""requestDatetime"":""2025-06-26T13:40:31Z"",""rawRequest"":{""actualSize"":1016,""httpRequest"":""R0VUIC93YWY/c3ZhbmdhPSUzQ3NjcmlwdCUzRWFsZXJ0KDEpJTNDL3NjcmlwdCUzRSUyMiBIVFRQLzEuMQ0KaG9zdDogY3liZXJ3YXNwLXN2LWhlbGxvd29ybGQuaWtwMzAwMXlucC5jbG91ZC51ay5oc2JjDQpjYWNoZS1jb250cm9sOiBtYXgtYWdlPTANCnNlYy1jaC11YTogIk5vdChBOkJyYW5kIjt2PSI5OSIsICJHb29nbGUgQ2hyb21lIjt2PSIxMzMiLCAiQ2hyb21pdW0iO3Y9IjEzMyINCnNlYy1jaC11YS1tb2JpbGU6ID8wDQpzZWMtY2gtdWEtcGxhdGZvcm06ICJXaW5kb3dzIg0KdXBncmFkZS1pbnNlY3VyZS1yZXF1ZXN0czogMQ0KdXNlci1hZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEzMy4wLjAuMCBTYWZhcmkvNTM3LjM2DQphY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LGltYWdlL2F2aWYsaW1hZ2Uvd2VicCxpbWFnZS9hcG5nLCovKjtxPTAuOCxhcHBsaWNhdGlvbi9zaWduZWQtZXhjaGFuZ2U7dj1iMztxPTAuNw0Kc2VjLWZldGNoLXNpdGU6IG5vbmUNCnNlYy1mZXRjaC1tb2RlOiBuYXZpZ2F0ZQ0Kc2VjLWZldGNoLXVzZXI6ID8xDQpzZWMtZmV0Y2gtZGVzdDogZG9jdW1lbnQNCmFjY2VwdC1lbmNvZGluZzogZ3ppcCwgZGVmbGF0ZSwgYnIsIHpzdGQNCmFjY2VwdC1sYW5ndWFnZTogZW4tVVMsZW47cT0wLjkNCnByaW9yaXR5OiB1PTAsIGkNCmNvb2tpZTogYWpzX3VzZXJfaWQ9NThhNzE0M2VkZjNhNTExOWI4MGMzYzQ1M2FjYmRjMTY1NWEwYTc5YTsgYWpzX2Fub255bW91c19pZD1jZTMzMmQxMi1iOTc0LTQ5ZTItYjkzYy0xNWVhYjVmYmEwNjQ7IGFtcF8zMzU1N2Q9bXJOSV9ZYTNrWlh3QUNtY1BhU2x4Ry4uLjFpbmVqdmlhdi4xaW5la240MHUuMC4wLjA7IGFtcF8zMzU1N2RfdWsuaHNiYz1tck5JX1lhM2taWHdBQ21jUGFTbHhHLi4uMWluZWp2aWIzLjFpbmVrbjQxMS4wLjAuMA0KDQo="",""isTruncated"":false},""requestPolicy"":{""fullPath"":""waf-fed-enforced""}}"",violation_details=""<?xml version='1.0' encoding='UTF-8'?>
<BAD_MSG>
<violation_masks>
<block>400500200500-1a01030000000032-0-0</block>
<alarm>20400500200500-1ef903400000003e-7400000000000000-0</alarm>
<learn>0-0-0-0</learn>
<staging>0-0-0-0</staging>
</violation_masks>
<request-violations>
<violation>
<viol_index>42</viol_index>
<viol_name>VIOL_ATTACK_SIGNATURE</viol_name>
<context>parameter</context>
<parameter_data>
<value_error/>
<enforcement_level>global</enforcement_level>
<name>c3Zhbmdh</name>
<value>PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0PiI=</value>
<location>query</location>
<expected_location>
</expected_location>
<is_base64_decoded>false</is_base64_decoded>
<param_name_pattern>*</param_name_pattern>
<staging>0</staging>
</parameter_data>
<staging>0</staging>
<sig_data>
<sig_id>200001475</sig_id>
<blocking_mask>3</blocking_mask>
<kw_data>
<buffer>c3ZhbmdhPTxzY3JpcHQ+YWxlcnQoMSk8L3NjcmlwdD4i</buffer>
<offset>8</offset>
<length>7</length>
</kw_data>
</sig_data>
<sig_data>
<sig_id>200000098</sig_id>
<blocking_mask>3</blocking_mask>
<kw_data>
<buffer>c3ZhbmdhPTxzY3JpcHQ+YWxlcnQoMSk8L3NjcmlwdD4i</buffer>
<offset>7</offset>
<length>7</length>
</kw_data>
</sig_data>
<sig_data>
<sig_id>200001088</sig_id>
<blocking_mask>2</blocking_mask>
<kw_data>
<buffer>c3ZhbmdhPTxzY3JpcHQ+YWxlcnQoMSk8L3NjcmlwdD4i</buffer>
<offset>15</offset>
<length>6</length>
</kw_data>
</sig_data>
<sig_data>
<sig_id>200101609</sig_id>
<blocking_mask>3</blocking_mask>
<kw_data>
<buffer>c3ZhbmdhPTxzY3JpcHQ+YWxlcnQoMSk8L3NjcmlwdD4i</buffer>
<offset>7</offset>
<length>25</length>
</kw_data>
</sig_data>
</violation>
</request-violations>
</BAD_MSG>"",bot_signature_name=""N/A"",bot_category=""N/A"",bot_anomalies=""N/A"",enforced_bot_anomalies=""N/A"",client_class=""Browser"",client_application=""Chrome"",client_application_version=""133"",request=""GET /waf?svanga=%3Cscript%3Ealert(1)%3C/script%3E%22 HTTP/1.1\r\nhost: cyberwasp-sv-helloworld.ikp3001ynp.cloud.uk.fed\r\ncache-control: max-age=0\r\nsec-ch-ua: ""Not(A:Brand"";v=""99"", ""Google Chrome"";v=""133"", ""Chromium"";v=""133""\r\nsec-ch-ua-mobile: ?0\r\nsec-ch-ua-platform: ""Windows""\r\nupgrade-insecure-requests: 1\r\nuser-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36\r\naccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\r\nsec-fetch-site: none\r\nsec-fetch-mode: navigate\r\nsec-fetch-user: ?1\r\nsec-fetch-dest: document\r\naccept-encoding: gzip, deflate, br, zstd\r\naccept-language: en-US,en;q=0.9\r\npriority: u=0, i\r\ncookie: ajs_user_id=58a7143edf3a5119b80c3c453acbdc1655a0a79a; ajs_anonymous_id=ce332d12-b974-49e2-b93c-15eab5fba064; amp_33557d=mrNI_Ya3kZXwACmcPaSlxG...1inejviav.1inekn40u.0.0.0; amp_33557d_uk.fed=mrNI_Ya3kZXwACmcPaSlxG...1inejvib3.1inekn411.0.0.0\r\n\r\n"",transport_protocol=""HTTP/2.0""";
RegexOptions options = RegexOptions.Multiline;
foreach (Match m in Regex.Matches(input, pattern, options))
{
Console.WriteLine("'{0}' found at index {1}.", m.Value, m.Index);
}
}
}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for C#, please visit: https://msdn.microsoft.com/en-us/library/system.text.regularexpressions.regex(v=vs.110).aspx