Asset tagging regular expression library (regex)

Document created by Parag Baxi on Jan 7, 2013Last modified by Kyle Rohan on Mar 23, 2015
Version 30Show Document
  • View in full screen mode

Updated 3/23/15 Fixed Windows 2000 Tags (both Server and Workstation) - Thanks Boyd!

Updated 1/6/15 adding Windows 8 Tag per request

Updated 8/19/14 with new more comprehensive Windows RegEx Strings!


This is an incomplete list. Please help out by commenting and I will try to add any helpful regex provided/requested.

Testing your regular expression

You can use the RegExr to check your regular expressions. RegExr has a character limit so I split up the identified operating systems into two links.

  1. RegExr prepopulated from 3com to Linksys Wireless
  2. RegExr prepulated from Linux to ZOT Print Server


Note: Case-insensitive option should be checked.



Contains this and that

Name contains "string1" AND "string2" then apply tag:


Contains this but not that

Name contains "string1" BUT NOT "string2" then apply tag.


Does not contain this

Name does not contain "".


Online example link.

Operating systems


Regex =



Examples regex works on:


AIX 4.3
AIX 4.3
AIX 5.2
AIX 5.x
AIX 6.1



Regex =



Examples regex works on:

Cisco IOS 12.1-12.2
Cisco VPN 3000 Concentrator
Cisco Device
Cisco IOS Version 12.2(25)SEE
Cisco CCS
Cisco RF Gateway
Cisco Firewall Services Module
Cisco IP Phone
Cisco ASA Firewall



Regex =



Examples regex works on:


Linux 2.2
Linux 2.2-2.6
Linux 2.4
Linux 2.4-2.6
Linux 2.4.20-3
Linux 2.6
Linux 2.6.x
Linux 2.x
Linux Based PGP Universal Server
Oracle Enterprise Linux 4
Oracle Enterprise Linux 5.5
Red Hat Enterprise Linux ES 3
Red Hat Enterprise Linux ES 4
Red Hat Enterprise Linux Server 5
Red Hat Enterprise Linux Server 6.0
SuSE Linux
SuSE Linux 10.1
SuSE Linux Enterprise Server 10 SP2
SuSE Linux Enterprise Server 9 SP4
Virtualized Linux Guest



Regex =



Examples regex works on:


MacOS X 


Non-Windows Host

Regex =



Examples regex works on:

3Com/D-Link Wireless Access Point / Brother PrinterAIX 5.3Cisco IOS Version 12.1(26)E2FreeBSD 5.x / AIX 5.1-5.3 / MacOSHP iLOHP JetDirectLinux 2.4-2.6 / Embedded Device / FUbuntu / Linux 2.6.xVMware ESXi 5.0.0 build 504890



Regex =

Xerox WorkCentre Printer|HP JetDirect|Print


Examples regex works on:

Brother MFC  HP JetDirectHP LaserJetLinkCom Xpress Print ServerXerox DocuPrint Printer



Regex =



Examples regex works on:


Solaris 10
Solaris 5.10 10/08 i386
Solaris 5.10 5/08 i386
Solaris 5.10 8/07 SPARC
Solaris 5.8 2/02 SPARC
Solaris 5.8 2/02 i386
Solaris 5.9 9/04 SPARC
Solaris 7-11
Solaris 8
Solaris 9-10
Solaris 9-11


Exact Windows OS Matches

Note: the following regex Strings are designed to only identify definitive OS matches in Qualys, i.e. those that have been scanned authenticated.  As such, it is recommend you also include a tag for "Windows Undefined" as listed below as part of your tagging hierarchy to capture all potential windows hosts.  Remember to check "ignore case" for all tagging rules below.


Windows Undefined (e.g. muti-match)

Accounts for mutiple windows matches with at least one "windows"  e.g. foo / bar / foo

Regex =

^Windows .*/((?!\/).)*


Windows Server 2003

Regex =

^Windows .*(2003)((?!\/).)*$

Windows Server 2008

Regex =

^Windows .*(2008)((?!\/).)*$

Windows Server 2012

Regex =

^Windows .*(2012)((?!\/).)*$

Windows Server 2000

Regex =

^Windows 2000 Server((?!\/).)*$

Windows 7

Regex =

^Windows .*(7)((?!\/).)*$


Windows 8

Regex =

^Windows .?(8)((?!\/).)*$


Windows 2000 (workstation)

Regex =

^Windows 2000 (?!Server)((?!\/).)*$|^Windows 2000$

Windows XP

Regex =

^Windows .*(xp)((?!\/).)*$


General Windows OS Matches

Note: This section includes more broad matching examples if you prefer to capture more hosts by TCP IP fingerprint + OS Identification.


Windows Server 2003

Regex =

^Windows Server 2003((?!\/).)*$|Windows 2003


Examples regex works on:

Windows Server 2003 64 bit Edition Service Pack 1
Windows Server 2003 64 bit Edition Service Pack 2
Windows Server 2003 R2 Service Pack 2
Windows Server 2003 Service Pack 1
Windows 2003


Windows servers

Regex =

^Windows .*Server((?!\/).)*$


Examples regex works on:

Windows 2000 Server
Windows Server 2003
Windows Server 2008
Windows HPC Server 2008
Windows Server 2008 R2
Windows Server 2012


Windows workstations

Regex =

^Windows (2000$|XP|7|8)((?!\/).)*$


Examples regex works on:

Windows 2000
Windows XP
Windows 7
Windows 8


7 people found this helpful