Skip to main content

Responses are generated using AI and may contain mistakes.

Attack Surface InsightsAttack Surface Insights Guide

Regular Expressions in Attack Surface Insights Search

When entering a search in Attack Surface Insights, use regular expressions to search for all entities by attribute values that match a pattern.

Regular expressions in Attack Surface Insights search are based on the Golang flavor of regex, with some limitations and differences.

Regex can be complex with a steep learning curve, so ensure you understand the syntax and test your queries before entering them in Attack Surface Insights.

To learn more about regex syntax, you can use the following resources:

  • Regex101 – To test and view an explanation of your regex pattern, select the Golang flavor from the panel, then enter a specific regex pattern.

  • RegExr– View an explanation of your regex pattern (not Golang-specific but very user-friendly).

  • RE2 Syntax Documentation – Reference for understanding the syntax for the specific regex engine Exabeam supports.

Enter a Regular Expression in Attack Surface Insights Search

To indicate that a query should be treated as regex, enclose the pattern in quotation marks.

Attack Surface Insights searches for all entities that match the regex pattern.

Example

"svc-backup-(prod|staging|dev)" returns all service accounts across prod, staging, and dev environments.

The pattern matches values like:

  • svc-backup-prod

  • svc-backup-staging

  • svc-backup-dev

Example

"srv-us-west-\d{2}" returns all servers named srv-us-west- followed by exactly two numbers

The pattern matches values like:

  • srv-us-west-01

  • srv-us-west-10

  • srv-us-west-99

Example

"admin-.*@acme\.com" returns any entity whose attribute value is acme.com and begins with admin-:

The pattern matches values like:

Example

"barbara.salazar" returns entities whose attribute value is barbara followed by any single character, then salazar.

The pattern matches values like:

  • barbara-salazar

  • barbara_salazar

  • barbara salazar

Regex Limitations in Attack Surface Insights Search

There are a few limitations to using regex in Attack Surface Insights search:

  • Attack Surface Insights uses the RE2 engine, which does not support certain syntax, like back referencing, look aheads, and look behinds, and can return inaccurate results in Attack Surface Insights search. To view the full list of regex operators the RE2 engine supports or doesn't support, view the RE2 syntax documentation.

  • Regex always searches the values of all entity attributes. You can't search the values of a specific entity attribute.

    Example

    user_name: "[a-z]+@ccc\.com" returns entities where user_name is literally [a-z]+@ccc\.com.

    To use regex, you must enter "[a-z]+@ccc\.com" as a standalone query that searches across all entity attributes.

  • Search application regex operators like RGX() and RGXi() are not supported. To indicate that a query should be treated as regex, enclose the regex in quotation marks.