--- title: "Regex Matching" slug: "regex-matching" updated: 2026-06-05T21:41:54Z published: 2026-06-05T21:41:54Z canonical: "help.nucleussec.com/regex-matching" stale: true --- > ## Documentation Index > Fetch the complete documentation index at: https://help.nucleussec.com/llms.txt > Use this file to discover all available pages before exploring further. # Regex Matching ## Overview Nucleus provides numerous opportunities to match data from different sources to automate processes in the Nucleus console. For example, you might want to search for naming conventions across different teams to standardize your organizational hierarchy. You can use regex matching in Nucleus wherever an indicator is shown for wildcard matching (*). To use regex matching, specify two forward slashes and type your regex expression within them. If you would like to specify different options to apply on the regular expressions, you will need to do so within the opening and closing forward slashes. For example, if you want the regular expression matches to be case insensitive, you will need to specify it like this: `/(?i)<replace-this-with-your-regular-expression>/` ### Examples For example, when trying to match all assets which have a name of 'asset_unique_identifier', you have two options: 1. Wildcard matching ``` asset_* ``` 1. Regex matching ``` /asset/ - any asset that has the string "asset" in its name or /^asset/ - only assets that begin with the name "asset" ``` Since any regex expressions will work within the // you can feel free to be as creative as you want, such as including OR operators, character classes, and more. **NOTE**: Outside the `//` will still resolve and attempt to match, so mixing and matching regex with standard wildcard matching might have unintended consequences. For example `/<valid-regular-expression>/i` will also try to match the letter 'i' as well as the regex expression within the double slashes. ### Regex Patterns for Finding References in Automation Rules #### Matching Finding References Finding References are scanner-specific metadata stored as JSON key-value pairs on each finding. You can create powerful automation rules by matching against these reference values using regular expressions. NOTE: Accessing finding references from automation rules requires an Organization-level setting. Please reach out to your Customer Success Manager to enable this feature. When the Org setting is enabled the **References** condition will be available for use with the *contains* qualifier under **Add Finding Processing Rule -> Rule Details -> Finding Criteria** ![Image](https://cdn.document360.io/3888970a-6501-459e-acc9-c47b71c6d64c/Images/Documentation/image(574).png) #### Understanding Finding References Format Finding references are stored internally as JSON. When you create an automation rule that matches on Finding References using the contains qualifier with a regex pattern, the system matches against the JSON-encoded string representation of the references. NOTE Use the following patterns in as the **Value** field with the References **Condition** The basic pattern for matching a specific key-value pair is: ``` /\"Key Name\":\"Value\"/ ``` For example, to match a finding where the reference key "Status" has the value "triaged": ``` /\"Status\":\"triaged\"/ ``` ### Common Regex Patterns #### Matching a Single Key-Value Pair Match findings where a specific reference field has an exact value: ``` /\"Is Fixable\":\"Yes\"/ ``` This matches any finding with a reference key "Is Fixable" set to "Yes". #### Matching Boolean-Style Values Many scanners store boolean-like values as "Yes"/"No", "true"/"false", or "1"/"0". Examples: ``` /\"Is Upgradable\":\"No\"/ /\"Is Patchable\":\"Yes\"/ /\"PCI Flagged\":\"true\"/ ``` #### Matching Multiple Possible Values (OR Logic) Use alternation (value1|value2) to match any of several possible values for a key: ``` /\"Project Type\":\"(maven|gradle|npm)\"/ ``` This matches findings where "Project Type" is either "maven", "gradle", or "npm". Another example matching multiple status values: ``` /\"Remediation Status\":\"(REMEDIATED|RESOLVED|FIXED)\"/ ``` ### Matching Keys with Special Characters When reference keys contain dots, spaces, or special characters, include them exactly as they appear: ``` /\"vendor\.risk_category\":\"(HIGH_RISK|CRITICAL)\"/ ``` ``` /\"CVSS Base Score\":\"[89]\.[0-9]\"/ ``` The second example matches CVSS Base Scores of 8.0-8.9 or 9.0-9.9 (High and Critical ranges). #### Matching Partial Values Use .* to match partial values within a reference field: ``` /\"Package Name\":\".*lodash.*\"/ ``` This matches any finding where the Package Name contains "lodash" anywhere in the value. ## Tips and Best Practices 1. **Escape quotes and colons:** Always use " for double quotes and : for colons in your patterns. Without proper escaping, the regex will not match. 2. **Test your patterns:** Before deploying automation rules to production, test your regex patterns using a regex tester to ensure they match the expected values. 3. **Case sensitivity:** Regex matching in automation rules is case-insensitive by default. The pattern /"Is Fixable":"yes"/ will match "Is Fixable":"Yes". 4. **Escape special characters:** If your values contain regex special characters like ., *, +, ?, [, ], (, ), escape them with a backslash. For example: /"Version":"1.0.0"/ 5. **Check available references:** To see what reference fields are available for your findings, view the Finding Details panel in Nucleus. The available fields vary by scanner type. 6. **Start simple:** Begin with simple single-condition patterns and add complexity as needed. Complex lookahead patterns can be harder to debug. ## Troubleshooting ### Pattern not matching expected findings: 1. Ensure you've escaped quotes (") and colons (:) with backslashes 2. Verify the exact key name and value spelling by viewing Finding Details 3. Remember that values are case-sensitive in the stored JSON (even though regex matching is case-insensitive) 4. Check for extra spaces or special characters in the key or value 5. Test with simpler patterns first to isolate which condition may be failing ## Places you can use this in Nucleus You can use regex matching anywhere there is an indicator for wildcard matching; it is especially useful in the [automation](/v1/docs/automation-workflows) section of Nucleus. Some examples where this can come in handy: - [Finding Processing Rules](/v1/docs/finding-processing-rules) for matching on finding references criteria - [Ticketing rules](/v1/docs/ticketing-rules) for asset matching criteria - [Asset Processing rules](/v1/docs/asset-processing-rules) for asset matching criteria - Asset Sync rules If you have questions about regex matching in Nucleus, let us know! We are happy to help!