topic Re: Extract the CVE value in Splunk Search

Extract the CVE value

rashid47010 — Fri, 17 Mar 2017 06:37:10 GMT

From IPS Event How can I extract only CVE value

XXXXDxxxre xxxrability (CVE-201x-00xx) (severity = Low)

I am writing:
rex "CVE-(?\d+\d+)"

but no event apprears

Re: Extract the CVE value

gcusello — Fri, 17 Mar 2017 07:37:04 GMT

Hi rashid47010,
try

\(CVE-(?<CVE>[^\)]*)\)

you can sse in https://regex101.com/r/Pmk72R/1

Bye.
Giuseppe

Re: Extract the CVE value

woodcock — Fri, 17 Mar 2017 14:36:39 GMT

Try this:

... | rex "CVE-(?<CVE>[^)]+)"

Re: Extract the CVE value

karimcisco — Tue, 29 Sep 2020 16:28:58 GMT

If you are using the TA Tenable do you need to create a props.conf file under and put the regex described by Giuseppe?

local karim$ pwd
/Applications/Splunk/etc/apps/Splunk_TA_nessus/local
local karim $ ls
inputs.conf

215:local karim $ more inputs.conf
[monitor:///Applications/Splunk/etc/apps/Splunk_TA_nessus/spool]
disabled = false
host = 127.0.0.1
sourcetype = CVE_2017

please advise

Thanks
Karim