topic REGEX issue with multiple criteria in Splunk Search

REGEX issue with multiple criteria

Scarecrowddb — Wed, 09 Mar 2011 13:59:24 GMT

Hi All,

I'm trying to filter our file audit logs, however I would like for it to ignore any files ending in .tmp

I can't seem to get the below to work properly... it seems to match on the event code and the Accesses but completely miss the Object Name for some reason?

REGEX = (?msi)EventCode=(4663|567|560).Object Name:\s(?!.tmp).Accesses:\s(DELETE|WRITE_DAC|WriteData)

An example log is:

20110309155132.000000
Category=3
CategoryString=Object Access
ComputerName=ComputerName
EventCode=560
EventIdentifier=560
EventType=4
Logfile=Security
RecordNumber=2572431
SourceName=Security
TimeGenerated=20110309155132.000000+600
TimeWritten=20110309155132.000000+600
Type=Audit Success
User=Username
wmi_type=WinEventLog:Security
Message=Object Open:

Object Server:  Security

Object Type:    File

Object Name:    G:\users\xxxxxx\Outlook .pst folders\~archive.pst.tmp

Handle ID:  7420

Operation ID:   {0,239001151}

Process ID: 4

Image File Name:    

Primary User Name:  SERVER$

Primary Domain: XXX

Primary Logon ID:   (0x0,0x3E7)

Client User Name:   User

Client Domain:  Domain

Client Logon ID:    (0x0,0xBA49FA7)

Accesses:   DELETE 
        ReadAttributes 


Privileges: -

Restricted Sid Count:   0

Access Mask:    0x10080

Any idea's as to where I'm going wrong would be appreciated....

Thanks,

Re: REGEX issue with multiple criteria

wollinet — Wed, 09 Mar 2011 23:06:19 GMT

Can you post some sample log records ?

Re: REGEX issue with multiple criteria

Scarecrowddb — Thu, 10 Mar 2011 06:31:29 GMT

Hi there, I've posted an example log above now.... thanks!

Re: REGEX issue with multiple criteria

wollinet — Thu, 10 Mar 2011 19:11:14 GMT

Try this one:

REGEX = (?msi)EventCode=(4663|567|560).Object Name:\s(?<!\.tmp).Accesses:\s(DELETE|WRITE_DAC|WriteData)

But I wonder if simply using "." to match over several lines really works. You can also try something like this:

REGEX = (?mi)^EventCode=(4663|567|560).*^Object Name:.*\.tmp$.*^Accesses:\s(DELETE|WRITE_DAC|WriteData)

Re: REGEX issue with multiple criteria

Scarecrowddb — Fri, 11 Mar 2011 05:16:43 GMT

Hi There... sorry, but neither of the above works....

Any other suggestions?

Re: REGEX issue with multiple criteria

Scarecrowddb — Mon, 14 Mar 2011 06:26:28 GMT

Any other idea's??

Re: REGEX issue with multiple criteria

wollinet — Wed, 16 Mar 2011 14:02:59 GMT

Just tried something like this and it seems to work:

(?msi)^EventCode=(540|567|560).Object Name:..tmp.*Accesses:\s(DELETE|WRITE_DAC|WriteData)

I couldn't try your exact pattern, but used a similar expression.