Very new to regex and was hoping someone could help me with the syntax of negating a regex search. Let me elaborate. I want to look at a packet/information and trigger a positive alert if one (or more) of multiple criteria is not found.
For instance, I want to search a packet and trigger positive if I cannot find one or more of the following strings: "aaa", "bbb", or "ccc".
I tried the following logic but it does not work because it will trigger on any criteria not aaa|bbb|ccc even if those strings are found elsewhere in the packet.
(\b[a-z0-9]+)\b(?<!\aaa|bbb|ccc)
Other similar arguments I have tried that do not work.
(!(?=.*[Aa][Aa][Aa])|(?=.*[Bb][Bb][Bb]))
(!?=.*[Aa][Aa][Aa])(!?=.*[Bb][Bb][Bb])
Any thoughts would be greatly appreciated.