The Google Cloud Security Community will be in read-only mode July 16 - July 22 as we migrate platforms. Read more and check out our FAQ.

[TheChris]

Hello,

I have the risk_score outcome below that is WORKING as expected, but I had to split the logic into two regex capture. I'm trying to have this in a single line, but due to the single group capture limit, I'm not able to have the intended regex (Mon|Tue|Wed|Thu|Fri) ([8-9]|1[0-8]) that would match both the day of week and hour. I want to match if it's "business hours" in London, between 8:00 and 18:59 Mon to Fri.

  outcome:
    $risk_score = max(
      100
      - if(
        re.capture(timestamp.get_timestamp($e.metadata.event_timestamp.seconds, "%a", "Europe/London"), "Mon|Tue|Wed|Thu|Fri") != ""
        and re.capture(timestamp.get_timestamp($e.metadata.event_timestamp.seconds, "%k", "Europe/London"), "[8-9]|1[0-8]") != ""
        , 50, 0)
    )

I tried this, but the single group capture limitation blocks me:

  outcome:
    $risk_score = max(
      100
      - if(
        re.capture(timestamp.get_timestamp($e.metadata.event_timestamp.seconds, "%a %k", "Europe/London"), "(Mon|Tue|Wed|Thu|Fri) ([8-9]|1[0-8])") != ""
        , 50, 0)
    )

I know about timestamp.get_hour and timestamp.get_day_of_week, but they would make the rule even longer/bigger, hence I'm using re.capture with timestamp.get_timestamp.

Any suggestions to have a single re.capture and timestamp.get_timestamp that can match both day of week and hour?

[jstoner]

I attempted a few other options but based on what I am seeing, the two options you laid out, two re.regex separated by and or the time functions are your best ways forward.

Generally, I would nudge folks toward the functions rather than the regex since functions will be more efficient than regex, but both will get the job done.

Someone with more re2 skills than myself (there are many of them) may have a better suggestion, but I'm not seeing one at the moment.

[TheChris · Accepted solution]

Answering my own question. It was so simple in the end, I don't even remember why I used re.capture, it wasn't even needed!

outcome:
    $risk_score = max(
        100
        - if(timestamp.get_timestamp($e.metadata.event_timestamp.seconds, "%a %k", "Europe/London") = /(Mon|Tue|Wed|Thu|Fri) ([8-9]|1[0-8])/, 50, 0)
    )