How I’m Using ChatGPT to Learn Regex

I’m preparing for the Linux Foundation’s Pattern Matching with Regular Expressions (SC107) credential, and I wanted more practice writing patterns myself. I used ChatGPT to build Regex, one step at a time, a study website organized around short lessons, practice text and highlighted matches.

Regular expressions, usually shortened to regex, describe patterns in text. In cybersecurity, they help pull useful details from logs: which account failed to sign in, which webpage someone requested or which program started.

Building a tool I can practice with

ChatGPT’s Sites functionality lets you describe a website and ask for changes. My goal was a study tool where I could type a pattern, see the selected text and understand what each part contributed.

Here is a prompt readers can adapt:

Build a regex study website using PCRE2. Teach one concept at a time. Give me sample text and let me type a pattern. Highlight matches and show extracted values. Keep hints and answers hidden until requested. Explain each part of the pattern, and include examples that should not match. Use fictional security logs.

The useful feedback is seeing where a match starts and stops. If I want only a username but select the rest of the message, I have something specific to correct. I can also ask ChatGPT for another example, change one character and predict the result before checking it.

Three ways regex helps with security work

These fictional, shortened examples use PCRE2, the regex engine targeted by my study tool. Each assumes the text format shown.

1. Windows: extract an account from a failed sign-in

Windows event 4625 records a failed sign-in. For practice, use this simplified version of its account field:

Sample text

TargetUserName=lab.user

Regex pattern

TargetUserName=(?<user>\S+)

This captures lab.user. (?<user>...) names the captured value, while \S+ selects one or more non-whitespace characters. An analyst can use that account name to review repeated failures alongside the source address and failure reason.

2. NGINX: extract a requested webpage

A webpage request recorded by the NGINX web server might look like:

Sample text

GET /login HTTP/1.1

Regex pattern

GET (?<target>\S+) HTTP/

The capture contains /login. The surrounding text identifies where the value begins and ends. Extracting it helps group requests to a login page and review them alongside response codes and client addresses.

This example handles the shown GET format. A query string, such as ?page=2, would also be included in the capture.

3. Sysmon: find PowerShell process starts

Sysmon event 1 records a program starting. Its Image field contains the program’s path, for example:

Sample text

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Apply this pattern to that field:

Regex pattern

(?i)\\powershell\.exe\z

It selects the final \powershell.exe, ignoring capitalization. \\ matches a backslash, \. matches a literal dot, and \z requires the end of the value. A path ending in powershell.exe.bak does not match.

This narrows a review to one program name. Its command line and parent process—the program that launched it—help explain the activity. The name alone does not establish malicious behavior.

Turning practice into exam preparation

My aim is to work through the exam topics until I can write a pattern without a hint, explain each part and test both matching and non-matching examples. ChatGPT helps create that practice; I still need to check its explanations against actual results.

In tools such as Splunk, rex turns named captures into fields. Use existing parsed fields when available, and check the destination tool’s regex syntax. For each new pattern, keep one example that should match and one that should not.