Skip to content

Cheatsheet

Regex for log and payload triage

Patterns you can paste into grep -E, a filter box or a notebook, with the caveats that matter.

17 entries4 groupsRevised 5 Jan 2026

Indicators

  • IPv4 address([0-9]{1,3}\.){3}[0-9]{1,3}
  • CIDR block([0-9]{1,3}\.){3}[0-9]{1,3}/([89]|[12][0-9]|3[0-2])
  • MAC address([0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2}
  • FQDN in a log line\b(?:[a-zA-Z0-9-]+\.)+[a-zA-Z]{2,}\b
  • URLhttps?://[^\s"'<>)]+

Common secrets and identifiers

  • PEM private key header-----BEGIN [A-Z ]*PRIVATE KEY-----
  • JWT (three base64url segments)eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*
  • AWS access key id shape\b(AKIA|ASIA)[0-9A-Z]{16}\b
  • Long hex blob (possible hash)\b[0-9a-f]{32,128}\b

HTTP and log work

  • Status code from a combined log line" ([0-9]{3}) [0-9]+
  • User-Agent valueMozilla.*\(([^)]*)\)
  • Query string parameter named 'next'[?&]next=([^&]*)
  • Anything URL-encoded%[0-9a-fA-F]{2}

Usage

  • Extended regex with grepgrep -E 'pattern' file
  • Only the matched partgrep -oE 'pattern' file | sort -u
  • Case-insensitive countgrep -icE 'pattern' file
  • Replace in place with a backupsed -Ei.bak 's/pattern/repl/g' file