In this section, you will learn to extract data using regex statements. This functionality allows greater specificity than a standard find and replace, particularly assisting the cybersecurity investigator to filter logs and cybersecurity data.
Grouping and subgrouping regex operators captures sections of the matched text for later use. These groups and subgroups can be referenced using a number. Group 0 is the match for the entire matched sequence; group 1 refers to the first set of parentheses found, and each subsequent set is 2, 3, 4, and so on.
The ability to group and subgroup might be an attempt to capture the source and destination IP addresses from a tcpdump output. In each line of packet capture, there are two IP addresses (source and destination). They always follow one another, separated by a > character, as in the following...
