topic Re: Trendmicro Regex Help in Splunk Search

Trendmicro Regex Help

CYBR_AH — Fri, 25 Mar 2016 22:57:47 GMT

Hi Community,

I'm trying to figure out how to get the signature and signature id to their own fields. This has been a tricky one for me. Here is part of the _raw event:

|Trend Micro|Deep Security Agent|0.0.0000|0|Invalid Traversal|
|Trend Micro|Deep Security Agent|0.0.0000|0000000|SSL Request|

After Deep Security Agent, there is the agent version. After the agent version is the signature ID, then finally the signature. The signature ID seems to range from a single digit number to 7 digits.

I'd like to be able to get the after everything after the agent version "\d.\d.\d{0,4}" and the pipe to end on the last character of the signature before the other pipe while also breaking up the signature ID field and signature field.

Any help would be great and much appreciated.

Re: Trendmicro Regex Help

jplumsdaine22 — Fri, 25 Mar 2016 23:20:50 GMT

Try this:

<your search> ... | rex field=_raw "^(?:.*?\K\|){4}(?<signature_id>[^\|]+)\|(?<signature>[^\|]+)"

I highly recommend this website for regex help: https://regex101.com/
Also the specific solution here came from perlmonks : http://www.perlmonks.org/?node_id=721801

Re: Trendmicro Regex Help

woodcock — Fri, 25 Mar 2016 23:34:46 GMT

Like this:

... | rex "(?:[\|][^\|]*){3}\|(?<SignatureID>[^\|]*)\|(?<Signature>[^\|]*)"

Re: Trendmicro Regex Help

CYBR_AH — Fri, 25 Mar 2016 23:49:37 GMT

Thank you this also worked!

Re: Trendmicro Regex Help

CYBR_AH — Fri, 25 Mar 2016 23:49:56 GMT

Thank you!

Re: Trendmicro Regex Help

jplumsdaine22 — Sat, 26 Mar 2016 00:12:46 GMT

This regex also looks more efficient than mine - you should probably accept this answer instead.

Re: Trendmicro Regex Help

CYBR_AH — Sat, 26 Mar 2016 00:14:47 GMT

Ok I will. I wish I could accept both.