Skip to main content
sjerry
Staff
Staff
November 22, 2025

Technical Tip: Use regular expression with device profiling rules

  • November 22, 2025
  • 0 replies
  • 201 views
Description This article provides an example of how to use a regular expression condition with device profiling rules.
Scope nacOS.
Solution

Assuming that an IP address from the host is obtained, and can do a NMAP scan. 


Perform a NMAP Scan: Users & Hosts -> Adapters -> 'Right click' -> NMAP Scan.

adapter.png

 

reg.png


When using more than one port, the following command can be executed:

 

(?s).*?(22|80)\/tcp\s+open.*?​

 

Singular conditions would be as follows:

 

22/tcp