topic Re: Another regex question in Splunk Search

Another regex question

jclehmuth — Mon, 10 Nov 2014 16:26:20 GMT

My current Regex is:

Retina: (?P'<'vuln'>\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+)\"on IP"$>
There are slashes in between the s's and w's but I can't figure that out either right now.

I'm trying to extract results similar to "Retina has found High Severity audit Microsoft Windows Authenticode Verification Code Execution (2653956)" from the following type of logs, but I only get a few results.

Nov 10 00:19:39 10.0.33.210 2014-11-10 5:19:25 Retina: Retina has found High Severity audit Microsoft Windows Authenticode Verification Code Execution (2653956) on ip 10.0.33.198.
Nov 10 00:19:47 10.0.33.210 2014-11-10 5:19:33 Retina: Retina has found Medium Severity audit Microsoft Windows Kernel Privilege Escalation (2711167) on ip 10.0.33.198.
Nov 10 00:19:41 10.0.33.210 2014-11-10 5:19:27 Retina: Retina has found High Severity audit Microsoft .NET Framework Remote Code Execution (2878890) - KB2863240 on ip 10.0.33.198.
Nov 10 00:19:30 10.0.33.210 2014-11-10 5:19:16 Retina: Retina has found Low Severity audit Microsoft VBScript/JScript Information Disclosure (2475792) - VBScript on ip 10.0.33.198.
Nov 10 00:19:48 10.0.33.210 2014-11-10 5:19:34 Retina: Retina has found Informational audit DNP3 Protocol Detected on ip 10.0.33.198.

Thanks in advance.

Re: Another regex question

jclehmuth — Mon, 10 Nov 2014 17:43:18 GMT

I can get it to partly work when I replace the "+" with "*"

Re: Another regex question

aljohnson_splun — Mon, 10 Nov 2014 18:08:45 GMT

Here I've copied your logs and tested out a regex that you could use. All you need to add is the field name.

Here's the example:
http://regexr.com/39sji

So your regex will look something like this:

 Retina: (?<vuln>.+?\(\d+\)

The thing you need to do add the +? which makes the regex non-greedy, it matches the least rather than the most. Then you just go to the end of the next group of digits that are also surrounded by parenthesis.

Re: Another regex question

jclehmuth — Mon, 10 Nov 2014 18:23:48 GMT

That seemed to work, thanks.

Re: Another regex question

rkent — Mon, 22 Jun 2015 17:53:01 GMT

While this works, if we allow a tiny bit of pedantry, I'd revise this regex to:

Retina: (?