How to search a Multi line windows event

krusty — Wed, 25 Apr 2012 13:59:38 GMT

Hi,

I'm trying to search a multiline event from a windows server. I need to find out which changes was made with a file. So I have to parse the Accesses. The field Accesses show me only the first entry but I need them all.
Have you any idea how I can search the events and find out the differnet accesses of a file?

For example an excerpt of the event.

    Accesses:   READ_CONTROL 
        ReadData (or ListDirectory) 
        WriteData (or AddFile) 
        AppendData (or AddSubdirectory or CreatePipeInstance) 
        ReadEA 
        WriteEA 
        ReadAttributes 
        WriteAttributes

At the end of my search I will show a report where I can see which operation will be done with the files. It should shown as a table. But first I have to figure out how to get the values out of the multiline event.

Thanks for your help.

Re: How to search a Multi line windows event

woodcock — Sun, 05 Jul 2015 18:56:14 GMT

Like this:

... | rex "(?ms)Accesses:\w+(?<MVAccesses>.*)$" | rex field=MVAccesses mode=sed "s/\n/:::/g" | makemv delim=":::" MVAccesses

Now your event contains a multi-value field called MVAccesses and you can do your work with that.

topic Re: How to search a Multi line windows event in Getting Data In

How to search a Multi line windows event

Re: How to search a Multi line windows event