A regular expression (commonly referred to as regex) is a sequence of characters that specifies a search pattern in text.

Become familiar with the following rules before using regular expressions:

  • Platform search normalizes all tokens such that any uppercase characters are converted to lowercase, and all backslashes (\) are converted to forward slashes (/).
  • Never include backslash or uppercase characters inside your regex statement.
  • Any use of backslashes in regex are valid only for escaping.
Table 1. Notable Regex Search Examples
Goal Sample Search
Using a generic regex.

Example: /regex/


Does not Work


Looking for process names with double extensions.

Example: file.doc.txt
All powershells that have performed a crossproc to anything but a specified process.

process_name:powershell.exe crossproc_name:/@~(ccmexec.exe)/
Does not Work

process_name:powershell.exe NOT crossproc_name:ccmexec.exe
process_name:powershell.exe crossproc_name:/@~(ccmexec.exe)/
Looking for netconns to any domain except a specified one.
process_name:winword.exe AND netconn_domain:/@~(microsoft.com)/

Looking for a file in a folder but not its subfolders.

Example: C:\Users\<user>\123.exe, but not C:\Users\<user>\subfolder\123.exe

Looking for an exact filename and not that name as a substring.

Example: find x64.exe BUT NOT installer-x64.exe
(process_original_filename:x64.exe AND -process_original_filename:/@&~(x64.exe)/)

Supported regex Syntax for Platform Search

When using Platform Search, any regex supported by Java is supported, with the Lucene syntax; thus: field:/regex/.

  • Use caution when starting anything with field:/.*something/.
    • These do not perform well on any fields that have a lot of values (also known as high cardinality).
    • Leading wildcard searches, such as field:/*something/, do not perform well.
  • All regex queries require an explicit fieldname, such as field:/regex/.

    Regex queries without a fieldname fail. For example, /regex/ is not a valid query.

Supported Predefined Character Classes for Platform Search

Predefined character classes are not supported.

For example: \d \D \w \W \s \S

Does not Work

Use regex to Exclude a Specific String during a Platform Search

Example case:

You want to find any winword.exe processes that have connected to any domain other than microsoft.com.

Writing the query without regex:
process_name:winword.exe AND netconn_domain:* AND NOT
does not give you that result. It excludes all processes that have connected to microsoft.com at any point.

Writing the query with regex, you can exclude a string in your search such as:
process_name:winword.exe AND

This query searches for any domain except the one provided. This ANYSTRING syntax is documented here: https://www.elastic.co/guide/en/elasticsearch/reference/current/regexp-syntax.html#regexp-optional-operators.

Case-sensitive regex Searches

In Platform Search, all tokenized fields, such as process_name, regmod_name, and process_cmdline, have their tokens converted to lowercase letters. Therefore, any regex searches that you perform on tokenized fields require you to use lowercase characters.

For example, if you are searching for a file with the string clip in the filename:

Does not Work