topic Re: Regex for multiple lines of a field value in Getting Data In

How to create regex for multiple lines of a field value?

RahulMisra — Wed, 30 Aug 2023 16:09:17 GMT

I want to extract numeric values into seperate field

"combinedrules": ["3000039", "3000081", "958052", "973335", "XSS-ANOMALY"]

Expected Output:

Ruleid

3000039

3000081

958052

Three might be a case when there could be 2 rules Id in one event and i wan to see both gets displayed in a single line

Re: Regex for multiple lines of a field value

gcusello — Fri, 25 Aug 2023 09:41:28 GMT

Hi @RahulMisra ,

could you share a sample of your full logs, not only a part of them?

Ciao.

Giuseppe

Re: Regex for multiple lines of a field value

RahulMisra — Fri, 25 Aug 2023 09:47:36 GMT

{"type": "testlog", "configId": "22269", "policyId": "FIST_52163", "anomali": "34.87.65.2", "combinedrules": ["3000039", "3000081", "958052", "973335", "XSS-ANOMALY"], "ruleMessages": ["Cross-site Scripting (XSS) Attack", "Cross-site Scripting (XSS) Attack", "Cross-site Scripting (XSS) Attack", "Cross-site Scripting (XSS) Attack", "Anomaly Score Exceeded for Cross-site Scripting (XSS) Attack"], "ruleTags": ["ASE/WEB_ATTACK/XSS", "ASE/WEB_ATTACK/XSS", "ASE/WEB_ATTACK/XSS", "ASE/WEB_ATTACK/XSS", "ASE/WEB_ATTACK/XSS"], "ruleData": ["document.domain", ")alert(", "alert(", "')alert(document.domain)", "Vector Score: 17, Group Threshold: 7, Triggered Rules: 3000081-958052-3000039-973335, Triggered Scores: 5-5-5-2, Triggered Selector: ARGS:errorCode, Mitigated Rules: , Last Matched Message: "], "ruleActions": ["alert", "alert", "alert", "alert", "deny"], "requestId": "2ed42ca7", "method": "GET", "Host": "test.goodies.com", "path": "/carbon/admin/login.jsp", "User-Agent": "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1866.237 Safari/537.36", "status": "403", "Server": "AkamaiGHost", "Date": "Fri, 25 Aug 2023 09:10:04 GMT"}

Re: Regex for multiple lines of a field value

Thulasinathan_M — Fri, 25 Aug 2023 16:33:45 GMT

Something like this?

| rex field=_raw "combinedrules\: \[(?<Rules>(.*[^(\]\,)?]))" | rex field=Rules max_match=0 "(?<RuleId>(\d+))" | stats count by RuleId

Re: Regex for multiple lines of a field value

PickleRick — Fri, 25 Aug 2023 16:50:13 GMT

It's not about a regex as such. It's about the whole props construction.

You have two options.

1. Use one transform to parse out the set of rules contained within brackets and then use another transform with SOURCE_KEY set to your extracted field and MV_ADD=true to further split it up into single values.

2. Parse out the whole set within brackets and then define TOKENIZER in fields.conf

The latter approach works with such lists while the first is a bit more generic.

Re: Regex for multiple lines of a field value

RahulMisra — Tue, 29 Aug 2023 08:45:03 GMT

So, we can;t make a regex on search to fetch the fields values ?