Please enable JavaScript to use regex101
/
^
r
e
g
e
x
[
\
-
_
]
?
1
0
1
$
/
i
Reg
ular
Ex
pressions
101
Upgrade to Pro
Enterprise
Regular Expression
/
"type":"(?P<threat_purpose>[^:]+):(?P<threat_resource_affected>[^\/]+)\/(?P<threat_name>[^!]+)\!(?P<threat_artifact>[^"]*?)
/
gm
Input 1
{"detail-type":"GuardDuty Finding","resources":[],"source":"aws.guardduty","id":"xxxxx-xx","detail":{"schemaVersion":"2.0","accountId":"1234567890","region":"us-west-2","partition":"aws","id":"xxxxxxxx","arn":"arn:aws:guardduty:us-west-2:1234567890:detector/XXXXXXX/finding/xxxxxxx","type":"Trojan:EC2/PhishingDomainRequest!DNS","resource":{"resourceType":"Instance","instanceDetails":{"instanceId":"i-99999999","instanceType":"m3.xlarge","launchTime":"2016-08-02T02:05:06Z","productCodes":[{"productCodeId":"GeneratedFindingProductCodeId","productCodeType":"GeneratedFindingProductCodeType"}],"iamInstanceProfile":{"arn":"GeneratedFindingInstanceProfileArn","id":"GeneratedFindingInstanceProfileId"},"networkInterfaces":[{"ipv6Addresses":[],"privateDnsName":"GeneratedFindingPrivateDnsName","privateIpAddress":"127.0.0.1","privateIpAddresses":[{"privateDnsName":"GeneratedFindingPrivateName","privateIpAddress":"127.0.0.1"}],"subnetId":"GeneratedFindingSubnetId","vpcId":"ein-ffdd1234","securityGrou
Extraction
{"detail-type":"GuardDuty Finding","resources":[],"source":"aws.guardduty","id":"xxxxx-xx","detail":{"schemaVersion":"2.0","accountId":"1234567890","region":"us-west-2","partition":"aws","id":"xxxxxxxx","arn":"arn:aws:guardduty:us-west-2:1234567890:detector/XXXXXXX/finding/xxxxxxx","type":"Trojan:EC2/PhishingDomainRequest!DNS","resource":{"resourceType":"Instance","instanceDetails":{"instanceId":"i-99999999","instanceType":"m3.xlarge","launchTime":"2016-08-02T02:05:06Z","productCodes":[{"productCodeId":"GeneratedFindingProductCodeId","productCodeType":"GeneratedFindingProductCodeType"}],"iamInstanceProfile":{"arn":"GeneratedFindingInstanceProfileArn","id":"GeneratedFindingInstanceProfileId"},"networkInterfaces":[{"ipv6Addresses":[],"privateDnsName":"GeneratedFindingPrivateDnsName","privateIpAddress":"127.0.0.1","privateIpAddresses":[{"privateDnsName":"GeneratedFindingPrivateName","privateIpAddress":"127.0.0.1"}],"subnetId":"GeneratedFindingSubnetId","vpcId":"ein-ffdd1234","securityGrou