Lion Cipher Lab
Regex for security: find the needle in the log
- Foundations
- Beginner
- ~40 min
- Free · no account required
Why it matters
A regular expression (regex) is a pattern that describes text — a compact way to say "find me every line that looks like this" instead of "find me this exact word." It is the skill hiding underneath almost everything defenders do with data: pulling IP addresses out of a firewall log, spotting email addresses in a leak, extracting just the failed logins from thousands of lines, writing a detection rule that fires on a shape rather than a single string. Log analysis, detection engineering, SIEM queries, and a large fraction of external practice rooms all assume you can already do this. Learn…
What you'll learn
- regular expressions
- grep -E (extended regex)
- character classes and anchors
- matching IP addresses
- matching email addresses
- extracting log lines
Steps in this lab
- What a regex is, and the tool we'll drive it with
- Build a practice file, then match literal text
- The wildcard dot, and quantifiers * and +
- Character classes: match a set, not just one letter
- Anchors: ^ start of line and $ end of line
- Groups and alternation: ( ) and |
- Real task 1: pull every IP address out of a log
- Real task 2: find email addresses in text
- Real task 3: extract failed-login lines (callback to the log lab)
- Why this is the skill under all the other skills