Pattern Match Examples

InsightConnect Workflows
,
1

After grappling with a tricky Pattern Match step yesterday, I wanted to share an example here and start a topic where other workflow builders can share their own examples! Please comment freely with:

  • Input String
  • Outputs (screenshots are great!)
  • The regular expression that got you there

I would also encourage people like me who may be struggling with this step to comment here with your Input String & Desired Outputs – we’ll help if we can!

Without further ado, here’s my pattern match scenario…

Input String

New Vuln "ssl-self-signed-certificate" on Asset "7"

Outputs:

{"vuln_id": "ssl-self-signed-certificate",
"asset_id": "7"}
image

Regex Pattern

"{{id:/([^"]*)/}}".*"{{asset_id:/([^"])/}}"

More Pattern Match Resources!

I’ll end this post with a couple of other handy resources for the Pattern Match step:

3 Likes
2

Get the JobID from the Job URL

Input String

{{[$job].[URL]}}

Outputs:

{"id":"37bcd987-2cfb-43e3-bd99-96776bdddf2f"}
image

Regex Pattern (case insensitive)

{{id:/[0-9A-F]{8}\-[0-9A-F]{4}\-[0-9A-F]{4}\-[0-9A-F]{4}\-[0-9A-F]{12}$/}}

3 Likes
3

Extract InsightVM Asset ID from the “New Vulnerability Found” IVM platform trigger.

Input:
{{["New Vulnerability Found"].[id]}}

Looks like this: 4ff14asq-827c-1337-bdd4-1cht3e7dkic8-default-asset-23

Regex (case-insensitive,no multi-match):
{{id:/\d+/}}$

4

Same for New Asset Found

5

FYI: I addressed this internally to get this changed so that the asset-id will be only the number at the end and can be directly used with the IVM plugin.

2 Likes
6

TL;DR: if you’re having trouble matching whitespace, look out for non-breaking spaces -   / U+00A0. If you’re using regex101.com to debug your pattern, be aware that if you paste non-breaking spaces into the regex101.com Test String field, it will silently turn them into regular spaces. Good times. :slight_smile:

I’ve just spent an over hour trying to match whitespace, and only now realized that there are non-breaking spaces in my input.

Goal

I want to read some variables from a text input for use in later Workflow steps. The input is originally from an email sent by a SAP module, which I’ve read using the Microsoft 365 plugin, and then pass through the HTML module to strip out tags/scripts, leaving me with just plain text.

The portion of input I’m testing looks like this:

Connection ID: C-999999 Leave Date: 05/13/2022

What I tried

I’m normally happy writing my regex without using additional tools. However, if I get stuck, I’ll lean on a utility like regex101.com because it can point out mistakes in my pattern I might be missing, and the step-by-step debug feature is really useful to see exactly where your pattern [doesn’t] match. If you’re reading this and you haven’t seen it, it’s well worth two minutes of your time to check it out.

Anyway, when I copied the string from the output of the HTML plugin step and pasted into regex101.com, the following pattern matched fine:

/C-(\d{5,}/

and that worked OK in the Pattern Match step as:

{{connection_id:/C-{{employee_connection_id:/\d{5,}/}}

When I added a single [normal] space onto the end of the pattern on regex101.com, it matched fine:

/C-(\d{5,} /

If my pattern matched the data in the regex101.com Test String field, the pattern must be correct for my data and should work inside the Insight Connect Pattern Match step, right? Wrong! :slight_smile:

Problem

When I brought the pattern back into the Pattern Match step, it failed every time:

{{connection_id:/C-{{employee_connection_id:/\d{5,} /}}

Underlying cause

After a while of trying various things which didn’t work, I decided to take a look at the input to the Pattern Match step using browser developer tools. Of course, it looks like this:

Connection ID: C-999999 Leave Date: 05/13/2022

The original email was full of non-breaking spaces, which don’t match either / / or /\s/ but look identical to a regular space on screen.

Solution

I tried adding a non-breaking space to the end of my pattern, and now it matches just fine:

C-{{connection_id:/\d{5,}/}}\x{A0}

I only showed two fields here, but my regex will be matching 15+ fields when it’s fully built. To keep things simpler, I’ve added a preceding Advanced Regex stage to replace all non-breaking space with a standard space. Since the Advanced Regex plugin uses Python syntax rather than RE2, the match pattern for a non-breaking space looks like this:

\u00A0

Wish I’d thought of all this an hour ago, but at least I know now. Hope this helps someone at some point.

4 Likes