Regex query - for matching everything except string

I'm trying to match up a regex expression here and I'm hoping for a direction.

I'm trying to ignore matches for the following list but match everything else around this commandline:

(?i)/FORMAT:[^(CSV|HFORM|HTABLE|LIST|MOF|RAWXML|TABLE|VALUE|XML)]

Can anyone else provide some direction?

To add more to my story: I'm trying to build a regex in Azure Sentinel to match all file extensions except the following list. Azure Sentinel uses Python Regex I believe and for the life of me I can't get it to work correctly.

Solution 1:

Just a guess.

(?i)\/FORMAT:(?!(?:CSV|HFORM|HTABLE|LIST|MOF|RAWXML|TABLE|VALUE|XML))\w+

?! means (colon) "not followed by".

?: means "don't capture this parenthesis" (makes it maybe a bit faster).

\w+ means "a word".

https://regex101.com/r/DmQwAa/1

Or do you mean something like:

(?i)^\S+\s+(?:[\/-]\S+\s+){0,100}[\/-]FORMAT:(?!(?:CSV|HFORM|HTABLE|LIST|MOF|RAWXML|TABLE|VALUE|XML))\S+\s+(?:[\/-]\S+(?:\s+|$)){0,100}$

https://regex101.com/r/DmQwAa/3

Need more examples from OP.