• • 此问题在此处已有答案**：

（9个答案）
3天前关闭。
我需要在以下文本中从日志中查找威胁ID

C:\\Users\\Administrator\\Downloads\\CallbackHell.exe}\r\nThreatID                       : 2147725414\r\nThreatStatusErrorCode          : 0\r\nThreatStatusID                 : 3\r\nPSComputerName                 : \r\n\r\nActionSuccess                  : True\r\nAdditionalActionsBitMask       : 0\r\nAMProductVersion               : 4.18.2211.5\r\nCleaningActionID               : 2\r\nCurrentThreatExecutionStatusID : 1\r\nDetectionID                    : {F9B830AE-D82E-4248-9D9D-723F2FB3AF95}\r\nDetectionSourceTypeID          : 3\r\nDomainUser                     : WIN-LIVFRVQFMKO\\Administrator\r\nInitialDetectionTime           : 1/9/2023 6:43:30 PM\r\nLastThreatStatusChangeTime     : 1/9/2023 6:43:59 PM\r\nProcessName                    : C:\\Windows\\explorer.exe\r\nRemediationTime                : 1/9/2023 6:43:59 PM\r\nResources                      : {file:_C:\\Users\\Administrator\\Desktop\\CallbackHell.exe:3\r\nPSComputerName                 : \r\n\r\nActionSuccess                  : True\r\nAdditionalActionsBitMask       : 0\r\nAMProductVersion               : 4.18.2211.5\r\nCleaningActionID               : 2\r\nCurrentThreatExecutionStatusID : 1\r\nDetectionID                    : {F9B830AE-D82E-4248-9D9D-723F2FB3AF95}\r\nDetectionSourceTypeID          : 3\r\nDomainUser                     : WIN-LIVFRVQFMKO\\Administrator\r\nInitialDetectionTime           : 1/9/2023 6:43:30 PM\r\nLastThreatStatusChangeTime     : 1/9/2023 6:43:59 PM\r\nProcessName                    : C:\\Windows\\explorer.exe\r\nRemediationTime                : 1/9/2023 6:43:59 PM\r\nResources                      : {file:_C:\\Users\\Administrator\\Desktop\\CallbackHell.exe}\r\nThreatID                       : 2147725414\r\nThreatStatusErrorCode          : 0\r\nThreatStatusID                 : 3,

我将表达式写为

ThreatStatusID                 : (.*)\\r\\nPSComputerName

但不知为何它不起作用

我在这里看到一个错误
我错在哪里？
我的密码是

try:
        re_filename_pattern = re.compile(r'\{file:_(.*)}')
        mo = re_filename_pattern.search(str(output))
        re_filename_pattern2 = re.compile(r'ThreatStatusID                 : (.*)\\r\\nPS')
        mo2 = re_filename_pattern2.search(str(output))
        if mo2 is not None and mo is not None:
            log += (mo.group(1)) + ":" + (mo2.group(1)) + ", "
    except:
        print('cant get filename')