using System;
using System.Text.RegularExpressions;
public class Example
{
public static void Main()
{
string pattern = @"\[\]\s\[(:?error|\S+:\S+)\]( \[pid \d+(:\S+ \d+)?\])?( \[client <HOST>(:\d{1,5})?\])+ ModSecurity:\s+(?:\[(?:\w+ \""[^\""]*\""|[^\]]*)\]\s*)*Access denied with code [45]\d\d";
string input = @"[] [:error] [pid 11954] [client <HOST>] [client <HOST>] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 4 at TX:anomaly_score. [file "".../modsecurity.d/owasp-modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf""] [line ""57""] [id ""949110""] [msg ""Inbound Anomaly Score Exceeded (Total Score: 5)""] [severity ""CRITICAL""] [tag ""application-multi""] [tag ""language-multi""] [tag ""platform-multi""] [tag ""attack-generic""] [hostname ""<HOST>""] [uri ""/phpmyadmin/phpmyadmin/index.php""] [unique_id ""W0uuY3C8AA4EAA5OC7wBAAAH""]
";
RegexOptions options = RegexOptions.Multiline;
foreach (Match m in Regex.Matches(input, pattern, options))
{
Console.WriteLine("'{0}' found at index {1}.", m.Value, m.Index);
}
}
}
Please keep in mind that these code samples are automatically generated and are not guaranteed to work. If you find any syntax errors, feel free to submit a bug report. For a full regex reference for C#, please visit: https://msdn.microsoft.com/en-us/library/system.text.regularexpressions.regex(v=vs.110).aspx