Solved

URGENT: Email Regex Help

Posted on 2014-02-05
6
386 Views
Last Modified: 2014-02-06
I am trying to put together a regex to search for specific emails in the To: section of an email header.  I have several email addresses, any one of which can be in the To: section of the header.  There may be one or several of the specific addresses and there must be a match if there are one or more of the addresses.

I have this as a start.

^To:\s+(usera|userb|userc|userd|usere|userf)@mydomain\.com

The email header may contain the following examples in any combination depending on the senders requirements, however I only need to trigger on the first match of the specific addresses.  Based on the regex finding the match, I will trigger other processes.  There also may be other extraneous email addresses which I expect will be ignored based on the criteria.

To: usera@mydomain.com
To: usera@mydomain.com, userb@mydomain.com
To: usera@mydomain.com, userb@mydomain.com, userc@mydomain.com
To: userb@mydomain.com, usere@mydomain.com

I have hit a wall as I am no expert at Regex.

Any help would be appreciated.
0
Comment
Question by:Craig Sharp
  • 4
  • 2
6 Comments
 
LVL 6

Accepted Solution

by:
lorenda earned 500 total points
ID: 39835775
What language/system are you writing this code in? How many email addresses are you searching for? If it's not a TON, it might be faster to simply write a Select statement to catch your emails.

For each msg in object.msg

'code to parse your userID's here, depending on your delimiters
'Also might add another loop here if there are multiple emails in a to field

Select Case userID

Case usera, userb, etc

End Case

next msg
0
 
LVL 3

Author Comment

by:Craig Sharp
ID: 39835816
Thank you for the reply.

This is being used in Postfix running on Linux.  It is designed to be a single Regex statement such as the example.  Postfix uses the regex to scan the email header and then act on that header match such as forwarding an email that has one or more of the addresses in question to a different email server.

I am searching for the first match of any of the specified users email addresses.  This will trigger the forward.
0
 
LVL 3

Author Comment

by:Craig Sharp
ID: 39835822
Sorry, I will be searching for about 8 specific email addresses.
0
Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

 
LVL 6

Expert Comment

by:lorenda
ID: 39835889
Ah - okay - what I posted above would really only work "well" client side ad hoc. Hopefully you'll find a postfix expert. :)
0
 
LVL 3

Author Comment

by:Craig Sharp
ID: 39835913
Thanks for your response Lorenda :-)
0
 
LVL 3

Author Closing Comment

by:Craig Sharp
ID: 39839196
I have found my solution:

^To:.*(usera@mydomain\.com|userb@mydomain\.com|userc@mydomain\.com)+

Lorenda, you were my only response.  Awarding you the points!

Thank you
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
Replace a tag with sed 2 41
Arduino EDI - Programming language 3 60
Internet Connection Util 8 69
Image decoding from Camera 3 44
This is an explanation of a simple data model to help parse a JSON feed
This is about my first experience with programming Arduino.
An introduction to basic programming syntax in Java by creating a simple program. Viewers can follow the tutorial as they create their first class in Java. Definitions and explanations about each element are given to help prepare viewers for future …
In this fifth video of the Xpdf series, we discuss and demonstrate the PDFdetach utility, which is able to list and, more importantly, extract attachments that are embedded in PDF files. It does this via a command line interface, making it suitable …

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now