topic Re: Pulling extracts from Snort alerts in Alerting

Pulling extracts from Snort alerts

richnsanders_70 — Wed, 28 Dec 2016 13:57:10 GMT

I'm trying to be less dependent on automated regex and learn more about doing my own regex for field extractions. I have have these fields from Snort (IP addresses have been modified):

12/27-13:46:30.535369 [**] [1:2019876:2] ET SCAN SSH BruteForce Tool with fake PUTTY version [**] [Classification: Detection of a Network Scan] [Priority: 3] {TCP} 100.31.116.39:35016 -> 172.20.16.2:22

12/27-13:34:12.027500 [**] [1:2500056:4184] ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 30 [**] [Classification: Misc Attack] [Priority: 2] {TCP} 100.83.149.133:58061 -> 172.20.16.2:22

I'm trying to extract between the first [**] and the second [**] giving me:

ET SCAN SSH BruteForce Tool with fake PUTTY version
AND
ET COMPROMISED Known Compromised or Hostile Host Traffic TCP group 29

The extract I put together is:
^\d{2}\/\d{2}-\d{2}:\d{2}:\d{2}\.\d{6}\s\s\[\*\*\]\s\[\d{1,3}:\d{2,7}:\d{1,4}\]\s(?P\D{15,75}\s)\[\*\*\]
It works on everything that doesn't end in a number such as TCP group 30, approximately 10% of my alerts end in a number such as 30. I've tried everything I can think of. Any help would be greatly appreciated!

Re: Pulling extracts from Snort alerts

richnsanders_70 — Wed, 28 Dec 2016 16:10:27 GMT

Solved myself ^\d{2}\/\d{2}-\d{2}:\d{2}:\d{2}\.\d{6}\s\s\[\*\*\]\s\[\d{1,3}:\d{2,7}:\d{1,4}\]\s(?P<alert>((\D|\d){15,75})\s)\[\*\*\]

Just goes to show, leave it alone for a bit and then come back.

Re: Pulling extracts from Snort alerts

gokadroid — Wed, 28 Dec 2016 17:44:35 GMT

Please try this regex:

your query to return events
|rex " \[\*\*\].*?\](?<etCapturedData>[^\[]+)\s*\[\*\*\]"
| table etCapturedData

You can rename etCapturedData field to any name of your choice by changing in (?<etCapturedData>[^\[]+)
For the Extraction and its explanation (check the right hand side columns) here

Re: Pulling extracts from Snort alerts

richnsanders_70 — Wed, 28 Dec 2016 18:11:16 GMT

The Rex does work, but I was looking for Field Extractions, I'm assuming this is probably a more elegant way of extracting than I used.

Re: Pulling extracts from Snort alerts

gokadroid — Thu, 29 Dec 2016 08:22:28 GMT

Same regex would have worked well in the field extraction too. But if you have solved it, then good, else this regex above is much more compact and will not be too dependent on the strict sequences of \d{n} as your regex might fail if:

The \d's were to mismatch in any log line.
If the content within the capturing group (\D|\d){15,75}) were to exceed 75 chars.