正則表達式語法 Regular Expression Syntax
http://www.ossec.net/doc/syntax/regex.html
目前OSSEC支持兩種：
- OR_Regex or regex
- OS_Match or sregex
1) OR_Regex or regex：C中簡單快速的正則表達式庫。
表達式 Supported expressions:
\w -> A-Z, a-z, 0-9 characters
\d -> 0-9 characters
\s -> For spaces " "
\t -> For tabs.
\p -> ()*+,-.:;<=>?[] (punctuation characters)
\W -> For anything not \w
\D -> For anything not \d
\S -> For anything not \s
\. -> For anything
修飾符 Modifiers:
+ -> To match one or more times (eg \w+ or \d+)
* -> To match zero or more times (eg \w* or \p*)
特殊字符 Special Characters:
^ -> To specify the beginning of the text.
$ -> To specify the end of the text.
| -> To create an "OR" between multiple patterns.
Characters Escaping
To utilize the following characters they must be escaped:
$ -> \$
( -> \(
) -> \)
\ -> \\
| -> \|
2) OS_Match or sregex：比上一種更快，但只支持簡單的字符串匹配和一些特殊字符。
特殊字符 Special Characters:
^ -> To specify the beginning of the text.
$ -> To specify the end of the text.
| -> To create an "OR" between multiple patterns.