topic Re: Extracting Linux permissions using rex in Splunk Search

Extracting Linux permissions using rex

izyknows — Sun, 13 Sep 2020 15:27:46 GMT

Hi all!

I'm looking to extract certain values from a Linux command line. Take the following example

| makeresults | eval sampleCLI="find / -perm -664 -type d 2>/dev/null" | eval sampleCLI2="find . -perm -2 -type d 2>/dev/null" | eval sampleCLI3="find . \( -perm -o rwx \) -type d 2>/dev/null" | eval sampleCLI4="find / -perm -o+w"

What I want is to extract the permissions and run some checks on it. For example, 664, 2, rwx and +w respectively in the above example. I'm having a hard type writing the regex query for this. I'm new to this and was trying to keep it simple and just get the value using negative matching like so

| rex field=sampleCLI* “find * -perm (?<permval>\S+)”

However the rex command doesn't even run. Throws up the following error: Error in 'rex' command: The regex '“find' does not extract anything. It should specify at least one named group. Format: (?<name>...).

Could someone please explain where I'm going wrong? Thanks very much!

Re: Extracting Linux permissions using rex

thambisetty — Sun, 13 Sep 2020 15:44:01 GMT

you can't use wildcard (*) in rex field attribute.

| rex field=sampleCLI "-perm\s+-(-0)?(?<permission>[^\s]+)" | rex field=sampleCLI2 "-perm\s+-(-0)?(?<permission>[^\s]+)"

Re: Extracting Linux permissions using rex

izyknows — Mon, 14 Sep 2020 05:45:42 GMT

Thank you, this is great. However, it does not match for commands like

find / -perm -o+w find . \( -perm -o rwx \) -type d 2>/dev/null

Is it possible for the same regex expression to have this?

Re: Extracting Linux permissions using rex

thambisetty — Mon, 14 Sep 2020 07:29:59 GMT

| rex field=yourfield "-perm(\s-o)?\s?(-|\+)?(?<permission>[^\s]+)"