Regex search

[frack113]

Hello,
I put a PR to sigmac because of Elastic not handling "^" and "$" in regexes (so query fail).

Should we add a 'convert' function to the class SigmaRegularExpression or should we let each backend re-code ?

I have no idea how to do this function correctly.

SigmaPartialRegularExpression get a bug, because I didn't test that carracter before adding ".*", so can have a ".something$." instead of ".*something$" ...

And when convert to elastic must be ".*something" to be correct.

[thomaspatzke]

I think the cleanest way would be the convert method like for strings. There's already an escape method that could be replaced with this, as now more than escaping would be done.

[thomaspatzke]

By the way, I think I will merge SigmaPartialRegularExpression into SigmaRegularExpression and move the logic to the modifier, similar to SigmaString and the contains modifier.

[frack113]

it make sense.
SigmaPartialRegularExpression is just a special use of SigmaRegularExpression