RegexExtractAll

Extraction of all matches from a specified regular expression pattern from a provided string. Returns an array of results. This differs from RegexGroups in several ways: * It returns all matches of the specified pattern, not just specific groups. This is useful for extracting things using a pattern where the content of the source string is indeterminate, such as extracting all email addresses. * Some "convenience" arguments have been added to enhance usability: multi-line, ignore_case, period_matches_newline * Added a new argument, "error_if_no_match". The script will not ordinarily throw an error if a match is not found but if not using as a transformer within a playbook, it may, in certain limited circumstances, be desirable to throw an error if the expression doesn't match. * It uses the 'regex' library, which supports more some more advanced regex functionality than the standard 're' library. For more info, see https://pypi.org/project/regex/.

python · Filters And Transformers

Details

ID	`RegexExtractAll`
Language	python
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10404775`
Tags	transformer string

README

Extraction of all matches from a specified regular expression pattern from a provided string. Returns an array of results. This differs from RegexGroups in several ways:

It returns all matches of the specified pattern, not just specific groups. This is useful for extracting things using a pattern where the content of the source string is indeterminate, such as extracting all email addresses.
Some “convenience” arguments have been added to enhance usability: multi-line, ignore_case, period_matches_newline
Added a new argument, “error_if_no_match”. The script will not ordinarily throw an error if a match is not found but if not using as a transformer within a playbook, it may, in certain limited circumstances, be desirable to throw an error if the expression doesn’t match.
It uses the ‘regex’ library, which supports more some more advanced regex functionality than the standard ‘re’ library. For more info, see https://pypi.org/project/regex/.

Script Data

Name	Description
Script Type	python3
Tags	transformer, string
Cortex XSOAR Version	5.0.0

Inputs

Argument Name	Description
value	Text to match against, e.g., The quick brown fox.
regex	Regex pattern to search (in Python), e.g., (The)\s(quick).*(fox).
multi_line	Process value in multiline mode. See more information on re.MULTILINE, see https://docs.python.org/3/library/re.html.
ignore_case	Whether character matching will be case-insensitive. Default is “false”.
period_matches_newline	Whether to make the ‘.’ character also match a new line. Default is “false”.
error_if_no_match	Only set to ‘true’ if used in a playbook task and you want that failure will return an error.
unpack_matches	Whether to unpack the tuple values of results. Default is “false”.

Outputs

There are no outputs for this script.

Source

RegexExtractAll.py RegexExtractAll_test.py RegexExtractAll.yml

Download History Raw

import demistomock as demisto


def test_main(mocker):
    from RegexExtractAll import main

    # test basic functionality
    with open("TestData/data.txt") as f:
        test_data = f.read()

    mocker.patch.object(
        demisto,
        "args",
        return_value={
            "value": test_data,
            "regex": r"\b[A-Za-z0-9._%=+\p{L}-]+@[A-Za-z0-9\p{L}.-]+\.[A-Za-z]{2,}\b",
            "multi_line": "false",
            "ignore_case": "false",
            "period_matches_newline": "false",
            "error_if_no_match": "false",
            "unpack_matches": "false",
        },
    )
    mocker.patch.object(demisto, "results")
    main()
    assert demisto.results.call_count == 1
    results = demisto.results.call_args[0][0]
    assert len(results) == 3
    assert results[0] == "test@test.com"
    assert results[1] == "testtrainee@test.com"
    assert results[2] == "testtrainee@test.com"

    # test case insensitive
    mocker.patch.object(
        demisto,
        "args",
        return_value={
            "value": test_data,
            "regex": r"\bTEST[A-Za-z@.]+\b",
            "multi_line": "false",
            "ignore_case": "true",
            "period_matches_newline": "false",
            "error_if_no_match": "false",
            "unpack_matches": "false",
        },
    )
    mocker.patch.object(demisto, "results")
    main()
    assert demisto.results.call_count == 1
    results = demisto.results.call_args[0][0]
    assert len(results) == 3
    assert results[0] == "test@test.com"
    assert results[1] == "testtrainee@test.com"
    assert results[2] == "testtrainee@test.com"

    # test unpack matches
    mocker.patch.object(
        demisto,
        "args",
        return_value={
            "value": test_data,
            "regex": r"([A-Za-z@.]+@([A-Za-z@.]+))",
            "multi_line": "false",
            "ignore_case": "true",
            "period_matches_newline": "false",
            "error_if_no_match": "false",
            "unpack_matches": "true",
        },
    )
    mocker.patch.object(demisto, "results")
    main()
    assert demisto.results.call_count == 1
    results = demisto.results.call_args[0][0]
    assert len(results) == 6
    assert results[0] == "test@test.com"
    assert results[1] == "test.com"
    assert results[2] == "testtrainee@test.com"
    assert results[3] == "test.com"
    assert results[4] == "testtrainee@test.com"
    assert results[5] == "test.com"