# KQL Query for non alphanumeric character sets

**URL:** <https://discuss.elastic.co/t/kql-query-for-non-alphanumeric-character-sets/204558>\
**Category:** Kibana\
**Tags:** kql-kibana-query-language\
**Created:** [October 21, 2019, 9:55pm UTC](https://discuss.elastic.co/t/kql-query-for-non-alphanumeric-character-sets/204558 "2019-10-21T21:55:20Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ericrs22](https://avatars.discourse-cdn.com/v4/letter/e/ecccb3/32.png) [@Ericrs22](https://discuss.elastic.co/u/Ericrs22)\
**Post date:** [October 21, 2019, 9:55pm UTC](https://discuss.elastic.co/t/kql-query-for-non-alphanumeric-character-sets/204558/1 "2019-10-21T21:55:20Z")

</div>

I've been checking manually for Brute Force attempts and I've noticed 99% of them come from attacks using Cyrillic character sets.

I've been trying to find the right query to setup an alert when we find non alphanumeric characters being used like cyrillic.

I've been trying to filter using `event.type:"authentication_failure" and NOT [a-z]`

---

<div class="post-metadata">

**Author:** ![bhavyarm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavyarm/32/22392_2.png) [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)\
**Post date:** [October 22, 2019, 10:24pm UTC](https://discuss.elastic.co/t/kql-query-for-non-alphanumeric-character-sets/204558/2 "2019-10-22T22:24:28Z")

</div>

@Bargs interesting question. Can we please get some help?

Thanks,  
Bhavya

---

<div class="post-metadata">

**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\
**Post date:** [October 24, 2019, 3:02am UTC](https://discuss.elastic.co/t/kql-query-for-non-alphanumeric-character-sets/204558/3 "2019-10-24T03:02:25Z")

</div>

KQL doesn't support regular expressions but Lucene does, so you might be able to use it to do what you need.

[https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html#\_regular\_expressions](https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html#_regular_expressions)

---

<div class="post-metadata">

**Author:** ![Ericrs22](https://avatars.discourse-cdn.com/v4/letter/e/ecccb3/32.png) [@Ericrs22](https://discuss.elastic.co/u/Ericrs22)\
**Post date:** [October 24, 2019, 4:46pm UTC](https://discuss.elastic.co/t/kql-query-for-non-alphanumeric-character-sets/204558/4 "2019-10-24T16:46:33Z")

</div>

Thanks @Bargs

Is there an example like using AND user.name NOT [a-z]

---

<div class="post-metadata">

**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\
**Post date:** [October 25, 2019, 5:36pm UTC](https://discuss.elastic.co/t/kql-query-for-non-alphanumeric-character-sets/204558/5 "2019-10-25T17:36:46Z")

</div>

The nitty gritty of Unicode is a bit out of my wheelhouse but I did a little searching. While [some regex engines](https://www.regular-expressions.info/unicode.html) support "Unicode scripts" which allow matching on characters from particular languages, it seems Elasticsearch's regex implementation does not support these. You may want to create an enhancement request on [Elasticsearch's github repo](https://github.com/elastic/elasticsearch). I can't think of any other good way to match on certain character sets at query time.

It might be easier to flag documents containing certain characters at index time.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 22, 2019, 5:36pm UTC](https://discuss.elastic.co/t/kql-query-for-non-alphanumeric-character-sets/204558/6 "2019-11-22T17:36:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.