透過集合功能整理內容
你可以依據偏好儲存及分類內容。
re.capture
re.capture(stringText, regex)
說明
使用引數中提供的規則運算式模式，從字串擷取資料。
這個函式會採用兩個引數：
stringText：要搜尋的原始字串。regex：表示要搜尋模式的規則運算式。
規則運算式可包含 0 或 1 個括號中的擷取群組。如果規則運算式包含 0 個擷取群組，函式會傳回第一個相符的完整子字串。如果規則運算式包含 1 個擷取群組，函式會傳回擷取群組的第一個相符子字串。定義兩個以上的擷取群組會傳回編譯器錯誤。
參數資料類型
STRING、STRING
傳回類型
STRING
程式碼範例
範例 1
在本範例中，如果 $e.principal.hostname 包含「aaa1bbaa2」，則下列項目為 true，因為函式會傳回第一個例項。這個範例沒有擷取群組。
"aaa1" = re.capture($e.principal.hostname, "a+[1-9]")
範例 2
這個範例會擷取電子郵件中 @ 符號後的所有內容。如果 $e.network.email.from 欄位為 test@google.com，範例會傳回 google.com。下列範例包含一個擷取群組。
"google.com" = re.capture($e.network.email.from , "@(.*)")
範例 3
如果規則運算式與文字中的任何子字串都不相符，函式會傳回空字串。您可以排除空字串，省略未發生相符項目的事件，這在使用 re.capture() 搭配不等式時特別重要：
// Exclude the empty string to omit events where no match occurs.
"" != re.capture($e.network.email.from , "@(.*)")
// Exclude a specific string with an inequality.
"google.com" != re.capture($e.network.email.from , "@(.*)")
除非另有註明，否則本頁面中的內容是採用創用 CC 姓名標示 4.0 授權，程式碼範例則為阿帕契 2.0 授權。詳情請參閱《Google Developers 網站政策》。Java 是 Oracle 和/或其關聯企業的註冊商標。
上次更新時間：2025-07-29 (世界標準時間)。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-07-29 (世界標準時間)。"],[[["\u003cp\u003e\u003ccode\u003ere.capture\u003c/code\u003e extracts data from a string based on a provided regular expression pattern, supporting up to one capture group.\u003c/p\u003e\n"],["\u003cp\u003eThe function returns the entire matching substring if no capture groups are defined in the regular expression or the substring within the capture group if one is defined.\u003c/p\u003e\n"],["\u003cp\u003eIf the regular expression doesn't find a match, \u003ccode\u003ere.capture\u003c/code\u003e returns an empty string, allowing for the exclusion of non-matching events using inequality operators.\u003c/p\u003e\n"],["\u003cp\u003e\u003ccode\u003ere.capture\u003c/code\u003e takes two arguments, the \u003ccode\u003estringText\u003c/code\u003e, and the \u003ccode\u003eregex\u003c/code\u003e, and both of these arguments must be of the type \u003ccode\u003eSTRING\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003e\u003ccode\u003ere.capture\u003c/code\u003e is supported in both \u003ccode\u003eRules\u003c/code\u003e and \u003ccode\u003eSearch\u003c/code\u003e environments, as specified in the supported in section.\u003c/p\u003e\n"]]],[],null,["### re.capture\n\nSupported in: \n[Rules](/chronicle/docs/detection/default-rules) [Search](/chronicle/docs/investigation/udm-search) \n\n re.capture(stringText, regex)\n\n#### Description\n\nCaptures (extracts) data from a string using the regular expression pattern\nprovided in the argument.\n\nThis function takes two arguments:\n\n- `stringText`: the original string to search.\n- `regex`: the regular expression indicating the pattern to search for.\n\nThe regular expression can contain 0 or 1 capture groups in parentheses. If the\nregular expression contains 0 capture groups, the function returns the first\nentire matching substring. If the regular expression contains 1 capture group,\nit returns the first matching substring for the capture group. Defining two or\nmore capture groups returns a compiler error.\n\n#### Param data types\n\n`STRING`, `STRING`\n\n#### Return type\n\n`STRING`\n\n#### Code samples\n\n##### Example 1\n\nIn this example, if `$e.principal.hostname` contains \"aaa1bbaa2\" the following would be true, because the function\nreturns the first instance. This example has no capture groups. \n\n \"aaa1\" = re.capture($e.principal.hostname, \"a+[1-9]\")\n\n##### Example 2\n\nThis example captures everything after the @ symbol in an email. If the\n`$e.network.email.from` field is `test@google.com`, the example returns\n`google.com`. The following example contains one capture group. \n\n \"google.com\" = re.capture($e.network.email.from , \"@(.*)\")\n\n##### Example 3\n\nIf the regular expression does not match any substring in the text, the\nfunction returns an empty string. You can omit events where no match occurs\nby excluding the empty string, which is especially important when you are\nusing `re.capture()` with an inequality: \n\n // Exclude the empty string to omit events where no match occurs.\n \"\" != re.capture($e.network.email.from , \"@(.*)\")\n\n // Exclude a specific string with an inequality.\n \"google.com\" != re.capture($e.network.email.from , \"@(.*)\")"]]
