Vikas
03/30/2023, 4:20 PMKathy Satterlee
03/30/2023, 4:22 PMVikas
03/30/2023, 4:23 PMKathy Satterlee
03/30/2023, 4:24 PMVikas
03/30/2023, 4:26 PMKathy Satterlee
03/30/2023, 4:27 PMVikas
03/30/2023, 4:27 PMKathy Satterlee
03/30/2023, 4:30 PMVikas
03/30/2023, 4:31 PMKathy Satterlee
03/30/2023, 4:32 PMVikas
03/30/2023, 4:33 PMKathy Satterlee
03/30/2023, 4:34 PMVikas
03/30/2023, 4:35 PMKathy Satterlee
03/30/2023, 4:36 PM/hosts
API for hosts that had been offline for 30 days, and then use the regex against the results.Vikas
03/30/2023, 4:36 PMKathy Satterlee
03/30/2023, 4:37 PMVikas
03/30/2023, 4:37 PMKathy Satterlee
03/30/2023, 4:37 PMVikas
03/30/2023, 4:39 PMKathy Satterlee
03/30/2023, 4:40 PMVikas
03/30/2023, 4:40 PMKathy Satterlee
03/30/2023, 4:41 PMVikas
03/30/2023, 4:42 PMKathy Satterlee
03/30/2023, 4:42 PMVikas
03/30/2023, 4:49 PM^[a-z]-(?:[a-z]{1,10}-){1,2}[0-9]{1,15}\.(?:staging|prod|dev)$
?Kathy Satterlee
03/30/2023, 4:51 PMVikas
03/30/2023, 4:52 PMKathy Satterlee
03/30/2023, 4:53 PMVikas
03/30/2023, 4:53 PMKathy Satterlee
03/30/2023, 4:53 PMVikas
03/30/2023, 4:56 PMKathy Satterlee
03/30/2023, 4:57 PMVikas
03/30/2023, 4:59 PMSELECT * FROM osquery_info where regex_match('hostname','^\w-(?:\w+-){1,2}\d{1,15}\.(?:staging|prod|dev)\.(?:abc\.com)$',0) is not null;
Kathy Satterlee
03/30/2023, 4:59 PMVikas
03/30/2023, 4:59 PMKathy Satterlee
03/30/2023, 5:09 PMSELECT 1 FROM system_info where regex_match(hostname,'^\w-(?:\w+-){1,2}\d{1,15}\.(?:staging|prod|dev)\.(?:abc\.com)$',0) is not null;
Vikas
03/30/2023, 5:13 PMSELECT 1 FROM system_info where regex_match(hostname,'^d*',0) is not null;
it will return hostnames start with dKathy Satterlee
03/30/2023, 5:16 PMSELECT hostname FROM system_info
Vikas
03/30/2023, 5:17 PMKathy Satterlee
03/30/2023, 5:28 PMVikas
03/30/2023, 5:39 PMKathy Satterlee
03/30/2023, 6:47 PM