https://community.splunk.com/t5/Knowledge-Management/TA-Linux-Auditd-for-OCSF-transforms-has-bugs/m-p/690709#M10101 <P>The transforms to set sourcetypes has a bug.<BR />The regex uses a capture group that is not used in the format statment.<BR />When this is the case splunk does not return a match on the regex.<BR />To get this to work it is neccessary to change the regex to a non-capturing group<BR />e.g. for:</P> <LI-CODE lang="markup">[auditdclasses2] REGEX = type\=(ANOM_|USER_AVC|AVC|CRYPTO_REPLAY_USER|RESP) DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::linux:audit:ocsf:finding</LI-CODE> <P><BR /><BR />must be change to&nbsp;<BR /><BR /></P> <LI-CODE lang="markup">REGEX = type\=(?:ANOM_|USER_AVC|AVC|CRYPTO_REPLAY_USER|RESP)</LI-CODE> <P><BR /><BR />Then it works.<BR />The same for the other auditdclasses1 - 6.</P> Fri, 14 Jun 2024 13:06:08 GMT ivarny 2024-06-14T13:06:08Z https://community.splunk.com/t5/Knowledge-Management/TA-Linux-Auditd-for-OCSF-transforms-has-bugs/m-p/690709#M10101 <P>The transforms to set sourcetypes has a bug.<BR />The regex uses a capture group that is not used in the format statment.<BR />When this is the case splunk does not return a match on the regex.<BR />To get this to work it is neccessary to change the regex to a non-capturing group<BR />e.g. for:</P> <LI-CODE lang="markup">[auditdclasses2] REGEX = type\=(ANOM_|USER_AVC|AVC|CRYPTO_REPLAY_USER|RESP) DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::linux:audit:ocsf:finding</LI-CODE> <P><BR /><BR />must be change to&nbsp;<BR /><BR /></P> <LI-CODE lang="markup">REGEX = type\=(?:ANOM_|USER_AVC|AVC|CRYPTO_REPLAY_USER|RESP)</LI-CODE> <P><BR /><BR />Then it works.<BR />The same for the other auditdclasses1 - 6.</P> Fri, 14 Jun 2024 13:06:08 GMT https://community.splunk.com/t5/Knowledge-Management/TA-Linux-Auditd-for-OCSF-transforms-has-bugs/m-p/690709#M10101 ivarny 2024-06-14T13:06:08Z