Tanium/Interact/Reg-Filter-Even-Numbered-hostnames/readme.md

🔍 Regex Filter for Even-Numbered Hostnames

This regex is used in Tanium filters to match hostnames ending with an even digit in their first label.

---

✅ Even-Numbered Hostnames (FQDN)

^[^.]*[02468]\..+

^[^.]* → matches the first label (hostname part before the first dot). [02468] → requires it to end with an even digit. ..+ → ensures there is a domain suffix (must be a FQDN).

Examples

• pc100.dkcorp.net ✅
• pc8.lab.example.org ✅
• pc101.sud.dkcorp.net ❌ (ends with odd digit 1)
• pc8 ❌ (not a FQDN, no dot)

✅ Even-Numbered Hostnames (Optional FQDN)

^[^.]*[02468](?:\..+)?$

^[^.]* → matches the first label (hostname part before the first dot). [02468] → requires it to end with an even digit. (?:..+)? → optional dot + domain (accepts both hostname and FQDN)

✅ Examples Matches:

• pc8
• pc100
• pc8.lab
• pc100.dkcorp.net

❌ Does not match:

• pc101 (ends with odd digit)
• pc8. (nothing after the dot)
• pc.8 (even digit not at the end of first label)