using System;
using System.Text.RegularExpressions;
public class Example
{
public static void Main()
{
string pattern = @"(Data\"": )\""";
string substitution = @"$1[";
string input = @"Event 1 :
=========
Input Event : [so much data exists in the same single line ] ,\""Comments\"": \""New alert\"", ""Data"": ""{\""etype\"":\""MalwareFamily\"",\""at\"":\""2024-06-21T11:34:07.0000000Z\"",\""md\"":\""2024-06-21T11:34:07.0000000Z\"",\""Investigations\"":[{\""$id\"":\""1\"",\""Id\"":\""urn:ZappedUrlInvestigation:2cc87ae3\"",\""InvestigationStatus\"":\""Running\""}],\""InvestigationIds\"":[\""urn:ZappedUrlInvestigation:2cc8782d063\""],\""Intent\"":\""Probing\"",\""ResourceIdentifiers\"":[{\""$id\"":\""2\"",\""AadTenantId\"":\""2dfb29-729c918\"",\""Type\"":\""AAD\""}],\""AzureResourceId\"":null,\""WorkspaceId\"":null,\""Metadata\"":{\""CustomApps\"":null,\""GenericInfo\"":null},\""Entities\"":[{\""$id\"":\""3\"",\""MailboxPrimaryAddress\"":\""abc@gmail.com\"",\""Upn\"":\""abc@gmail.com\"",\""AadId\"":\""6eac3b76357\"",\""RiskLevel\"":\""None\"",\""Type\"":\""mailbox\"",\""Urn\"":\""urn:UserEntity:10338af2b6c\"",\""Source\"":\""TP\"",\""FirstSeen\"":\""0001-01-01T00:00:00\""}, \""StartTimeUtc\"": \""2024-06-21T10:12:37\"", \""Status\"": \""Investigation Started\""}"",""EntityType"": ""MalwareFamily"", [so much data exists in the same single line ]
Event 2 :
=======
[so much data exists in the same single line ] ,\""Comments\"": \""New alert\"", ""Data"": ""{\""etype\"":\""MalwareFamily\"",\""at\"":\""2024-06-21T11:34:07.0000000Z\"",\""md\"":\""2024-06-21T11:34:07.0000000Z\"",\""Investigations\"":[{\""$id\"":\""1\"",\""Id\"":\""urn:ZappedUrlInvestigation:2cc87ae3\"",\""InvestigationStatus\"":\""Running\""}],\""InvestigationIds\"":[\""urn:ZappedUrlInvestigation:2cc8782d063\""],\""Intent\"":\""Probing\"",\""ResourceIdentifiers\"":[{\""$id\"":\""2\"",\""AadTenantId\"":\""2dfb29-729c918\"",\""Type\"":\""AAD\""}],\""AzureResourceId\"":null,\""WorkspaceId\"":null,\""Metadata\"":{\""CustomApps\"":null,\""GenericInfo\"":null},\""Entities\"":[{\""$id\"":\""3\"",\""MailboxPrimaryAddress\"":\""abc@gmail.com\"",\""Upn\"":\""abc@gmail.com\"",\""AadId\"":\""6eac3b76357\"",\""RiskLevel\"":\""None\"",\""Type\"":\""mailbox\"",\""Urn\"":\""urn:UserEntity:10338af2b6c\"",\""Source\"":\""TP\"",\""FirstSeen\"":\""0001-01-01T00:00:00\""}, \""StartTimeUtc\"": \""2024-06-21T10:12:37\"", \""Status\"": \""Investigation Started\""}"",""ids"": [9654,""78b3""], [so much data exists in the same single line ]
Event 3 :
==========
[so much data exists in the same single line ] ,\""Comments\"": \""New alert\"", ""Data"": ""{\""etype\"":\""MalwareFamily\"",\""at\"":\""2024-06-21T11:34:07.0000000Z\"",\""md\"":\""2024-06-21T11:34:07.0000000Z\"",\""Investigations\"":[{\""$id\"":\""1\"",\""Id\"":\""urn:ZappedUrlInvestigation:2cc87ae3\"",\""InvestigationStatus\"":\""Running\""}],\""InvestigationIds\"":[\""urn:ZappedUrlInvestigation:2cc8782d063\""],\""Intent\"":\""Probing\"",\""ResourceIdentifiers\"":[{\""$id\"":\""2\"",\""AadTenantId\"":\""2dfb29-729c918\"",\""Type\"":\""AAD\""}],\""AzureResourceId\"":null,\""WorkspaceId\"":null,\""Metadata\"":{\""CustomApps\"":null,\""GenericInfo\"":null},\""Entities\"":[{\""$id\"":\""3\"",\""MailboxPrimaryAddress\"":\""abc@gmail.com\"",\""Upn\"":\""abc@gmail.com\"",\""AadId\"":\""6eac3b76357\"",\""RiskLevel\"":\""None\"",\""Type\"":\""mailbox\"",\""Urn\"":\""urn:UserEntity:10338af2b6c\"",\""Source\"":\""TP\"",\""FirstSeen\"":\""0001-01-01T00:00:00\""}, \""StartTimeUtc\"": \""2024-06-21T10:12:37\"", \""Status\"": \""Investigation Started\""}"",""Name"": ""Phishing Categroy"", [so much data exists in the same single line ]
======
";
Regex regex = new Regex(pattern);
string result = regex.Replace(input, substitution);
}
}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for C#, please visit: https://msdn.microsoft.com/en-us/library/system.text.regularexpressions.regex(v=vs.110).aspx