import java.util.regex.Matcher;
import java.util.regex.Pattern;
public class Example {
public static void main(String[] args) {
final String regex = "CEF:(?<cef_cefVersion>\\d+)\\|(?<deviceVendor>[^|]*)\\|(?<deviceProduct>[^|]*)\\|(?<deviceVersion>[^|]*)\\|(?<deviceEventClassId>[^|]*)\\|(?<name>[^|]*)\\|(?<severity>[^|]*)";
final String string = "CEF:0|NombreDeFabricante|NombreDeProducto|1.0|IdentificadorTipoEvento|NombreEvento|High| eventId=6642904107 type=2 mrt=1435653826633 sessionId=0 generatorID=qn7nr00BABCAAWmHK722fQ\\=\\= catdt=Sinkhole modelConfidence=0 severity=0 relevance=10 assetCriticality=0 priority=3 art=1435653847001 cat=Bot deviceSeverity=Warning act=Mevade rt=1435653777000 shost=HostOrigen src=IPOrigen sourceZoneID=MfdHjJR0BABCAT9DSiOoDxQ\\=\\= sourceZoneURI=/All Zones/ArcSight System/Public Address Space Zones/RIPE NCC/62.0.0.0-62.255.255.255 (RIPE NCC) sourceGeoCountryCode=ES sourceGeoLocationInfo=NombreCiudad slong=-3.xxx slat=43.xxx sourceGeoPostalCode=xxxxx sourceGeoRegionCode=xx dhost=HostDestino dst=IPDestino destinationZoneID=Mokee5CcBABCGKZ5Updd27g\\=\\= destinationZoneURI=/All Zones/ArcSight System/Public Address Space Zones/RIPE NCC/193.0.0.0-195.255.255.255 (RIPE NCC) dpt=80 destinationGeoCountryCode=PT destinationGeoLocationInfo=NombreCiudad dlong=-9.xxx dlat=38.xxx destinationGeoPostalCode=xxx destinationGeoRegionCode=xx fname=Conexiones maliciosas filePath=/Ruta al fname/Conexiones maliciosas fileType=Rule request=http://HostDestino/policy ruleThreadId=SeiiQ04BABD9xHYRcACZnw\\=\\= cs1=Unknown cs2=<Resource URI\\=\"/xxxxxxxxxxx/Conexiones maliciosas\" ID\\=\"5ATikaUQBABDArjxMSXCuNQ\\=\\=\"/> cs6=CFYDHANP cn1=6739 flexNumber1=8 locality=1 cs1Label=Nombre ASN cs2Label=Configuration Resource ahost=xxxx.incibe.es agt=xxx.xxx.xxx.xxx av=5.1.2.5857.0 atz=Europe/Madrid aid=qn7nr00BABCAAWmHK722fQ\\=\\= at=superagent_ng dvchost=xxxx.incibe.es dvc=xxx.xxx.xxx.xxx deviceZoneID=Mbp432AABABCDUVpYAT3UdQ\\=\\= deviceZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 172.16.0.0-172.31.255.255 deviceZoneExternalID=RFC1918: 172.16.0.0-172.31.255.255 deviceAssetId=4W0dT8T4BABCAV5TwjQThbw\\=\\= dtz=Europe/Madrid deviceFacility=Rules Engine eventAnnotationStageUpdateTime=1435653827604 eventAnnotationModificationTime=1435653827604 eventAnnotationAuditTrail=1,1435635335503,root,Queued,,,,\\n eventAnnotationVersion=1 eventAnnotationFlags=0 eventAnnotationEndTime=1435653777000 eventAnnotationManagerReceiptTime=1435653826633 _cefVer=0.1 ad.arcSightEventPath=3PUhT8T4BABCAYJTwjQThbw\\=\\= baseEventIds=6642903984\n"
+ "CEF:0|NombreDeFabricante|NombreDeProducto|1.0|IdentificadorTipoEvento|NombreEvento|High| eventId=6642904107 type=2 mrt=1435653826633 sessionId=0 generatorID=qn7nr00BABCAAWmHK722fQ\\=\\= catdt=Sinkhole modelConfidence=0 severity=0 relevance=10 assetCriticality=0 priority=3 art=1435653847001 cat=Bot deviceSeverity=Warning act=Mevade rt=1435653777000 shost=HostOrigen src=IPOrigen sourceZoneID=MfdHjJR0BABCAT9DSiOoDxQ\\=\\= sourceZoneURI=/All Zones/ArcSight System/Public Address Space Zones/RIPE NCC/62.0.0.0-62.255.255.255 (RIPE NCC) sourceGeoCountryCode=ES sourceGeoLocationInfo=NombreCiudad slong=-3.xxx slat=43.xxx sourceGeoPostalCode=xxxxx sourceGeoRegionCode=xx dhost=HostDestino dst=IPDestino destinationZoneID=Mokee5CcBABCGKZ5Updd27g\\=\\= destinationZoneURI=/All Zones/ArcSight System/Public Address Space Zones/RIPE NCC/193.0.0.0-195.255.255.255 (RIPE NCC) dpt=80 destinationGeoCountryCode=PT destinationGeoLocationInfo=NombreCiudad dlong=-9.xxx dlat=38.xxx destinationGeoPostalCode=xxx destinationGeoRegionCode=xx fname=Conexiones maliciosas filePath=/Ruta al fname/Conexiones maliciosas fileType=Rule request=http://HostDestino/policy ruleThreadId=SeiiQ04BABD9xHYRcACZnw\\=\\= cs1=Unknown cs2=<Resource URI\\=\"/xxxxxxxxxxx/Conexiones maliciosas\" ID\\=\"5ATikaUQBABDArjxMSXCuNQ\\=\\=\"/> cs6=CFYDHANP cn1=6739 flexNumber1=8 locality=1 cs1Label=Nombre ASN cs2Label=Configuration Resource ahost=xxxx.incibe.es agt=xxx.xxx.xxx.xxx av=5.1.2.5857.0 atz=Europe/Madrid aid=qn7nr00BABCAAWmHK722fQ\\=\\= at=superagent_ng dvchost=xxxx.incibe.es dvc=xxx.xxx.xxx.xxx deviceZoneID=Mbp432AABABCDUVpYAT3UdQ\\=\\= deviceZoneURI=/All Zones/ArcSight System/Private Address Space Zones/RFC1918: 172.16.0.0-172.31.255.255 deviceZoneExternalID=RFC1918: 172.16.0.0-172.31.255.255 deviceAssetId=4W0dT8T4BABCAV5TwjQThbw\\=\\= dtz=Europe/Madrid deviceFacility=Rules Engine eventAnnotationStageUpdateTime=1435653827604 eventAnnotationModificationTime=1435653827604 eventAnnotationAuditTrail=1,1435635335503,root,Queued,,,,\\n eventAnnotationVersion=1 eventAnnotationFlags=0 eventAnnotationEndTime=1435653777000 eventAnnotationManagerReceiptTime=1435653826633 _cefVer=0.1 ad.arcSightEventPath=3PUhT8T4BABCAYJTwjQThbw\\=\\= baseEventIds=6642903984\n";
final Pattern pattern = Pattern.compile(regex);
final Matcher matcher = pattern.matcher(string);
while (matcher.find()) {
System.out.println("Full match: " + matcher.group(0));
for (int i = 1; i <= matcher.groupCount(); i++) {
System.out.println("Group " + i + ": " + matcher.group(i));
}
}
}
}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for Java, please visit: https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html