>我目前正在从 .audit 文件中填充一个列表,并将两条信息提取到 Map 中。以下是文件的外观:
type : REGISTRY_SETTING
description : "1.9.56 Network security: Do not store LAN Manager hash value on next password change: Enabled"
info : "This control defines whether the LAN Manager (LM) hash value for the new password is stored when the password is changed."
solution : "Make sure 'Do not store LAN Manager hash value on next password change' is Enabled."
reference : "PCI-DSS|8.4,800-53|AC-3,800-53|SC-5,800-53|CM-7,800-53|CM-6,CCE|CCE-8937-5"
see_also : "https://benchmarks.cisecurity.org/tools2/windows/CIS_Microsoft_Windows_7_Benchmark_v1.2.0.pdf"
value_type : POLICY_DWORD
reg_key : "HKLMSystemCurrentControlSetControlLsa"
reg_item : "NoLMHash"
value_data : 1
type : REGISTRY_SETTING
description : "1.13.3 Notify antivirus programs when opening attachments: Enabled"
info : "This control defines whether antivirus program to be notified when opening attachments."
solution : "Make sure 'Notify antivirus programs when opening attachments' is Enabled."
reference : "800-53|SI-3,PCI-DSS|5.1.1,CCE|CCE-10076-8,PCI-DSS|5.1"
see_also : "https://benchmarks.cisecurity.org/tools2/windows/CIS_Microsoft_Windows_7_Benchmark_v1.2.0.pdf"
value_type : POLICY_DWORD
reg_key : "HKUSoftwareMicrosoftWindowsCurrentVersionPoliciesAttachments"
reg_item : "ScanWithAntiVirus"
value_data : 3
reg_ignore_hku_users : "S-1-5-18,S-1-5-19,S-1-5-20"
我需要地图采用<description,value_data>
格式,无论value_data
之后是否有任何内容,例如:
Key: "1.9.56 Network security: Do not store LAN Manager hash value on next password changed."
Value: 1
这是我当前用于用地图的键值填充地图的代码:
String descriptionString = Pattern.quote("description") + "(.*?)" + Pattern.quote("info");
Pattern descriptionPattern = Pattern.compile(descriptionString);
Matcher descriptionMatcher = descriptionPattern.matcher(auditContentList.get(i));
while(descriptionMatcher.find())
{
System.out.println("Key found ");
customItemMap.put(descriptionMatcher.group(1),"");
}
问题是我不能在任何给定时间同时使用两个正则表达式来填充 Map 的同一索引。有没有更好的方法可以做到这一点?
对于您的示例数据,也许您应该尝试以下方法:
description.*?"(.*?)"[sS]*?value_data.*?(d+)
我已经测试过了[这里]