@@ -46,14 +46,14 @@ class MicrosoftSentinelTokenizer(QueryTokenizer, OperatorBasedMixin):
4646 field_pattern = r"(?P<field_name>[a-zA-Z\.\-_]+)"
4747 bool_value_pattern = rf"(?P<{ MicrosoftValueType .bool_value } >true|false)\s*"
4848 num_value_pattern = rf"(?P<{ MicrosoftValueType .number_value } >\d+(?:\.\d+)*)\s*"
49- double_quotes_value_pattern = rf'"(?P<{ MicrosoftValueType .double_quotes_value } >(?:[:a-zA-Z\*0-9=+%#\-_/,\'\.$&^@!\(\)\{{\}}\[\]№ ;<>?`~\s]|\\\"|\\\\)*)"\s*' # noqa: E501
50- single_quotes_value_pattern = rf"'(?P<{ MicrosoftValueType .single_quotes_value } >(?:[:a-zA-Z\*0-9=+%#\-_/,\"\.$&^@!\(\)\{{\}}\[\]№ ;<>?`~\s]|\\\'|\\\\)*)'\s*" # noqa: E501
51- verbatim_double_quotes_value_pattern = rf'@"(?P<{ MicrosoftValueType .verbatim_double_quotes_value } >(?:[:a-zA-Z\*0-9=+%#\-_/,\'\.$&^@!\(\)\{{\}}\[\]№ ;<>?`~\s\\]|"")*)"\s*' # noqa: E501
52- verbatim_single_quotes_value_pattern = rf"@'(?P<{ MicrosoftValueType .verbatim_single_quotes_value } >(?:[:a-zA-Z\*0-9=+%#\-_/,\"\.$&^@!\(\)\{{\}}\[\]№ ;<>?`~\s\\]|'')*)'\s*" # noqa: E501
49+ double_quotes_value_pattern = rf'"(?P<{ MicrosoftValueType .double_quotes_value } >(?:[:a-zA-Z\*0-9=+%#\-_/,\'\.$&^@!\(\)\{{\}}\[\];<>?`~\s]|\\\"|\\\\)*)"\s*' # noqa: E501
50+ single_quotes_value_pattern = rf"'(?P<{ MicrosoftValueType .single_quotes_value } >(?:[:a-zA-Z\*0-9=+%#\-_/,\"\.$&^@!\(\)\{{\}}\[\];<>?`~\s]|\\\'|\\\\)*)'\s*" # noqa: E501
51+ verbatim_double_quotes_value_pattern = rf'@"(?P<{ MicrosoftValueType .verbatim_double_quotes_value } >(?:[:a-zA-Z\*0-9=+%#\-_/,\'\.$&^@!\(\)\{{\}}\[\];<>?`~\s\\]|"")*)"\s*' # noqa: E501
52+ verbatim_single_quotes_value_pattern = rf"@'(?P<{ MicrosoftValueType .verbatim_single_quotes_value } >(?:[:a-zA-Z\*0-9=+%#\-_/,\"\.$&^@!\(\)\{{\}}\[\];<>?`~\s\\]|'')*)'\s*" # noqa: E501
5353 str_value_pattern = rf"""{ double_quotes_value_pattern } |{ single_quotes_value_pattern } |{ verbatim_double_quotes_value_pattern } |{ verbatim_single_quotes_value_pattern } """ # noqa: E501
5454 _value_pattern = rf"""{ bool_value_pattern } |{ num_value_pattern } |{ str_value_pattern } """
5555 multi_value_pattern = (
56- rf"""\((?P<{ MicrosoftValueType .multi_value } >[:a-zA-Z\"\*0-9=+%#\-_\/\\'\,.&^@!\(\[\]№ ;<>?`~\s]+)\)"""
56+ rf"""\((?P<{ MicrosoftValueType .multi_value } >[:a-zA-Z\"\*0-9=+%#\-_\/\\'\,.&^@!\(\[\];<>?`~\s]+)\)"""
5757 )
5858 keyword_pattern = rf"\*\s+contains\s+(?:{ str_value_pattern } )"
5959
0 commit comments