正则表达式入门：如何开始发现敏感数据

The dot

.

The period means any character.

net.rix will match both www.netwrix.com and www.netfrix.com.

Character class

[]

Matches for anything inside the square brackets.
The one exception is the ^ character. Inside a class, at the beginning, the ^ means exception from the search. For example [^n] will match any character except n; this is called a negated character class.
Note that metacharacters (with one exception) are not active inside classes. For example, [net$] will match any of the characters n, e, t or $ ($ is a metacharacter, but inside a character class it matches only $).
The one exception is the ^ character. Inside a class, at the beginning, the ^ means exception from the search. For example [^n] will match any character except n; this is called a negated character class.

You can list characters individually; for instance, net[wrx] will match netw , netr and netx but not netz.
Or you can look for a range of characters by giving two characters and separating them by a hyphen; for example, net[a-z] will match neta, netw and netf but not net1.

Anchors

^

Used to match characters at the beginning of a string

^https will match https://netwrix.com but not www.netwrix.com or http://netwrix.com

$

Used to match characters at the end of a string

com$ will match www.netwrix.com or telecom but not computer.

Iteration / quantifiers

?

Matches the preceding element zero or one time (it will always match if the character was not found). It is great for finding optional characters.

colou?r will match both color and colour.

*

Matches the preceding element zero or more times instead of zero or once. It is great for finding optional series of characters.

ne*t will match nt (zero e characters), net (one e ), neeet (three e characters), and so forth.

+

Matches the preceding element one or more times.
Pay careful attention to the difference between * and +. * matches zero or more times, so whatever’s being repeated may not be present at all; + requires at least one occurrence.

ne+t will match net and neeet but not nt.

|

The choice operator matches either the expression before or the expression after the operator.

net|wrix will match net and wrix.

{}

{x} matches if the element that precedes it is found exactly x times.
{x,y} matches if the preceding element is found at least x times but not more than y times.

n{3} will match nnn , nnnn and nnnd (because they all include n three times in a row), but it will not match nnw.
9{3} will match 999, 1234999124 and text999text, but not 84299238, 9909, or page992.
n{3,5} will match nnn, nnnn and nnnnn.

Blocking and capturing

()

Defines a subexpression that can be recalled later using shorthand: The first subexpression in parentheses can be recalled by \1, the second can be recalled by \2 and so on.
Parentheses are normally used either with | (the choice operator) inside or with quantifiers on the outside.

Gr(a|e)y will match Gray or Grey.
[0-9]([-])[0-9]\1[0-9] will match 3-4-2 and 4-6-1, but not 1-23, 42-1 or 234.

Escape sequence

\

The metacharacter that follows the slash will be used as a literal.
Note that some sequences beginning with \ are not escape sequences. Instead, they represent predefined sets of characters that are often useful, such as the set of digits, the set of letters, or the set of anything that isn’t whitespace. The most popular ones are listed below as “special metacharacters.”

www\.netwrix\.com will match www.netwrix.com but not www,netwrix,com.

Special metacharacters

\s

Matches any whitespace character (a space, a tab, a line break or a form feed).

Netwrix\sAuditor will match Netwrix Auditor, and Netwrix(tab)Auditor, but not Netwrix<5 spaces> Auditor or NetwrixAuditor.

\S

Matches any non-whitespace character.

\Snetwrix will match Xnetwrix and 1netwrix.

\w

Matches any alphanumeric character.

\w\w\w will match net, dfw and Netwrix.

\W

Matches any non-alphanumeric character.

netwrix\W will match netwrix! and netwrix?.

\d

Matches any decimal digit.

Netwrix\d\d will match Netwrix80 and Netwrix90.

\D

Matches any non-digit character.

Netwrix\D will match Netwrix) and Netwrix-.

\a

Matches any single alphabetic character, either capital or lowercase.

net\arix will match netWrix, netfrix and netarix.

\b

Defines a word boundary.

\brix will match rix and rixon but not netwrix.

\B

Defines a non-word boundary

\Brix will match Netwrix and trix but not rixon.

Email addresses

^[\w\.=-]+@[\w\.-]+\.[\w]{2,3}$

T.Simpson@netwrix.com

U.S. Social Security numbers

\b(?!000|666|9\d{2})([0-8]\d{2}|7([0-6]\d))([-]?|\s{1})(?!00)\d\d\2(?!0000)\d{4}\b

513-84-7329

IPV4 addresses

^\d{1,3}[.]\d{1,3}[.]\d{1,3}[.]\d{1,3}$

192.168.1.1

Dates in MM/DD/YYYY format

^([1][12]|[0]?[1-9])[\/-]([3][01]|[12]\d|[0]?[1-9])[\/-](\d{4}|\d{2})$

05/05/2018

MasterCard numbers

^(?:5[1-5][0-9]{2}|222[1-9]|22[3-9][0-9]|2[3-6][0-9]{2}|27[01][0-9]|2720)[0-9]{12}$

5258704108753590

Visa card numbers

\b([4]\d{3}[\s]\d{4}[\s]\d{4}[\s]\d{4}|[4]\d{3}[-]\d{4}[-]\d{4}[-
]\d{4}|[4]\d{3}[.]\d{4}[.]\d{4}[.]\d{4}|[4]\d{3}\d{4}\d{4}\d{4})\b

4563-7568-5698-4587

American Express card numbers

^3[47][0-9]{13}$

34583547858682157

U.S. ZIP codes

^((\d{5}-\d{4})|(\d{5})|([A-Z]\d[A-Z]\s\d[A-Z]\d))$

97589

File paths

\\[^\\]+$

\\fs1\shared

URLs

(?i)\b((?:[a-z][\w-]+:(?:\/{1,3}|[a-z0-9%])|www\d{0,3}[.]|[a-z0-9.\-]+[.][a-z]{2,4}\/)(?:[^\s()<>]+|\(([^\s()<>]+|(\([^\s()<>]+\)))*\))+(?:\(([^\s()<>]+
|(\([^\s()<>]+\)))*\)|[^\s`!()\[\]{};:'".,<>?«»“”‘’]))

www.netwrix.com