topic Regex exclude multiple subnets in Getting Data In

Regex exclude multiple subnets

eprovin — Thu, 15 Aug 2019 18:31:29 GMT

I'm trying to filter out a couple subnets using regex. This works fine: | regex connection.ip != "^172.16.\d{1,3}.\d{1,3}$" but when I'm having troubles excluding another subnet.

This does not work for me: | regex connection.ip != "^172.16.\d{1,3}.\d{1,3}$|^10.10.\d{1,3}.\d{1,3}$"

Any suggestions?

Thanks!

Re: Regex exclude multiple subnets

Sukisen1981 — Thu, 15 Aug 2019 18:43:36 GMT

can we see the sample events and what you are trying to extract?

Re: Regex exclude multiple subnets

eprovin — Wed, 30 Sep 2020 01:45:12 GMT

index="divit" sourcetype="pps_messagelog" final_module=spam final_rule="safe" | dedup msg.header.message-id{}
| transaction filter.qid
| regex connection.ip != "^172.16.\d{1,3}.\d{1,3}$"
| table _time,connection.sid,filter.qid,envelope.from,msg.header.to,subject,connection.ip,connection.host

Re: Regex exclude multiple subnets

Sukisen1981 — Thu, 15 Aug 2019 18:47:37 GMT

i meant your event samples...we need to see the two subnets you refer to and why the second rex is failing

Re: Regex exclude multiple subnets

richgalloway — Thu, 15 Aug 2019 18:47:52 GMT

We need to see sample data to know what regex string will match it.

Re: Regex exclude multiple subnets

eprovin — Thu, 15 Aug 2019 19:01:46 GMT

Sorry - newbie here. Is this what you're looking for?

  connection:   {   [-] 
     country:    eu 
     helo:   omp.save.spirit-airlines.com   
     host:   omp.save.spirit-airlines.com   
     ip:     12.130.136.48  
     protocol:   smtp:smtp  
     resolveStatus:  ok 
     sid:    2ubf9su5eg 
     tls:   {   [+] 
    }   
}

Re: Regex exclude multiple subnets

solarboyz1 — Thu, 15 Aug 2019 19:04:51 GMT

Based on the example of /16 or /24, you could just use wildcard:

| search connection.ip!=172.16.* AND connection.ip!=10.10.*

or you could use cidrmatch if you need more complex matching:

| where NOT cidrmatch(172.16.0.0/16,connection.ip)

Or you might just try loosening up your regex, by removing the startline (^) and endline ($) markers, in case the value is space padded:

| regex connection.ip != "172.16.\d{1,3}.\d{1,3}|10.10.\d{1,3}.\d{1,3}"

Re: Regex exclude multiple subnets

eprovin — Fri, 16 Aug 2019 00:21:59 GMT

Thanks for the suggestion, but it still will only remove whichever filter is first. Any other ideas?

Re: Regex exclude multiple subnets

eprovin — Fri, 16 Aug 2019 13:57:03 GMT

Loosening the regex did seem to do the trick - thanks!