I wasn’t saying that you shouldn’t go with PCRE, I’m just saying that if you go with PCRE and people feel free to use the full spectrum you’ll almost certainly run into instances where
tools using their native regex libraries won’t be compatible. Adding a non-normative note with a subset identified that’s supported across a variety of libraries will help minimize this.
From:
Ivan Kirillov <ikirillov@mitre.org>
Date: Tuesday, June 14, 2016 at 11:21 AM
To: Jason Keirstead <Jason.Keirstead@ca.ibm.com>, "Wunder, John A." <jwunder@mitre.org>
Cc: John-Mark Gurney <jmg@newcontext.com>, "cti-cybox@lists.oasis-open.org" <cti-cybox@lists.oasis-open.org>
Subject: Re: [cti-cybox] Regex for Patterning
I believe it supports Unicode matching, at least via Unicode characters:
“Character matching assumes a Unicode character set. Note that no syntax is supplied for
specifying code points in hex; actual Unicode characters must be used instead.”
So I suppose the question is if we want to support Unicode matching via code points; if so, then we should probably just go with PCRE.
Regards,
Ivan
From:
<cti-cybox@lists.oasis-open.org> on behalf of Jason Keirstead <Jason.Keirstead@ca.ibm.com>
Date: Monday, June 13, 2016 at 6:28 PM
To: John Wunder <jwunder@mitre.org>
Cc: John-Mark Gurney <jmg@newcontext.com>, "cti-cybox@lists.oasis-open.org" <cti-cybox@lists.oasis-open.org>
Subject: Re: [cti-cybox] Regex for Patterning
The problem with that subset (at least as currently written) is it would not support unicode.
-
Jason Keirstead
STSM, Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security | www.securityintelligence.com
Without data, all you are is just another person with an opinion - Unknown
"Wunder, John A." ---06/13/2016 09:22:24 PM---I support this, just
wanted to point out some material we wrote up for regex in CybOX 2.1: http://cy
From: "Wunder, John A." <jwunder@mitre.org>
To: Jason Keirstead/CanEast/IBM@IBMCA, John-Mark Gurney <jmg@newcontext.com>
Cc: "cti-cybox@lists.oasis-open.org" <cti-cybox@lists.oasis-open.org>
Date: 06/13/2016 09:22 PM
Subject: Re: [cti-cybox] Regex for Patterning
Sent by: <cti-cybox@lists.oasis-open.org>
I support this, just wanted to point out some material we wrote up for regex in CybOX 2.1:
http://cyboxproject.github.io/documentation/regex-support/. The intent was to identify the
subset of PCRE that’s compatible across the most common programming languages and frameworks. It or something like it could be included as non-normative text or best practices to encourage people to use more compatible regexes.
(Please ignore the note at the bottom about alternative syntaxes, we shouldn’t do that).
John
From: <cti-cybox@lists.oasis-open.org> on behalf of Jason Keirstead <Jason.Keirstead@ca.ibm.com>
Date: Monday, June 13, 2016 at 8:15 PM
To: John-Mark Gurney <jmg@newcontext.com>
Cc: "cti-cybox@lists.oasis-open.org" <cti-cybox@lists.oasis-open.org>
Subject: Re: [cti-cybox] Regex for Patterning
Seconded - we need to move forward.
-
Jason Keirstead
STSM, Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security | www.securityintelligence.com
Without data, all you are is just another person with an opinion - Unknown
John-Mark Gurney ---06/13/2016
09:14:02 PM---Hello, I would like resolve the issue of regex for patterning.
From: John-Mark Gurney <jmg@newcontext.com>
To: cti-cybox@lists.oasis-open.org
Date: 06/13/2016 09:14 PM
Subject: [cti-cybox] Regex for Patterning
Sent by: <cti-cybox@lists.oasis-open.org>
Hello,
I would like resolve the issue of regex for patterning.
Unless anyone voices any objections, we will use PCRE as the regex grammar for the MATCHES operator.
Thanks.
John-Mark