MatchRegexV2

Extracts regex data from the provided text. The script support groups and looping.

Type

python

Pack

CommonScripts

Source

import re

import demistomock as demisto
from CommonServerPython import *

LETTER_TO_REGEX_FLAGS = {
    "i": re.IGNORECASE,
    "m": re.MULTILINE,
    "s": re.DOTALL,
    "u": re.UNICODE,
}


def parse_regex_flags(raw_flags: str = "gim"):
    """
    parse flags user input and convert them to re flags.

    Args:
        raw_flags: string chars representing er flags

    Returns:
        (re flags, whether to return multiple matches)

    """
    raw_flags = raw_flags.lstrip("-")  # compatibility with original MatchRegex script.
    multiple_matches = "g" in raw_flags
    raw_flags = raw_flags.replace("g", "")
    flags = re.RegexFlag(0)
    for c in raw_flags:
        if c in LETTER_TO_REGEX_FLAGS:
            flags |= LETTER_TO_REGEX_FLAGS[c]
        else:
            raise ValueError(f'Invalid regex flag "{c}".\nSupported flags are {", ".join(LETTER_TO_REGEX_FLAGS.keys())}')

    return flags, multiple_matches


def main(args: dict):
    data: str = args.get("data")  # type: ignore[assignment]
    raw_regex = args.get("regex", "")
    group = int(args.get("group", "0"))
    context_key = args.get("contextKey", "")
    flags, multiple_matches = parse_regex_flags(args.get("flags", "gim"))

    regex = re.compile(raw_regex, flags=flags)
    # in case group is out of range, fallback to all matching string
    if group > regex.groups:
        group = 0

    results = []
    if multiple_matches:
        regex_result = regex.search(data)
        while regex_result:
            results.append(regex_result.group(group))
            regex_result = regex.search(data, regex_result.span()[1])
    else:
        regex_result = regex.search(data)
        if regex_result:
            results = regex_result.group(group)  # type: ignore[assignment]

    results = results[0] if len(results) == 1 else results

    human_readable = json.dumps(results) if results else "Regex does not match."

    context = {}
    if context_key:
        context = {context_key: results}

    # clearing the context field in order to override it instead of appending it.
    demisto.setContext("MatchRegex.results", results)
    return CommandResults(
        readable_output=human_readable,
        outputs=context,
        raw_response=results,
    )


if __name__ in ("__main__", "__builtin__", "builtins"):
    try:
        return_results(main(demisto.args()))
    except Exception as exc:
        return_error(str(exc), error=exc)

README