Hello all,
I am ingesting NetScaler Logs on Splunk with sourcetype "citrix:netscaler:syslog". For the set I receive, I am interested in WAF events that include either one of the following words:
- APPFW_CONTENT_TYPE
- APPFW_XSS
- APPFW_BUFFEROVERFLOW_URL
- APPFW_SQL
The issue is that I need four different regexes for all of these four events. I have set in my props.conf the following declarations, but unfortunately not all fields are extracted:
# APPFW_CONTENT_TYPE
EXTRACT-function,src,dest_host,dest,signature_desc,action = .*(?<function>SSLVPN|SSLLOG|APPFW|EVENT)\sAPPFW_CONTENT_TYPE[0-9 \:]{15}(?<src>((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)).*\s(?<dest_host>www.unisystems.gr)\s(?<dest>https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|www\.[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9]\.[^\s]{2,}|www\.[a-zA-Z0-9]\.[^\s]{2,})(?<signature_desc>.*)\<(?<action>.*)\>
# APPFW_XSS
EXTRACT-src,dest_host,dest,signature_desc,action = .*(?<function>SSLVPN|SSLLOG|APPFW|EVENT)\sAPPFW_XSS.*\s[0-9 \:]{14}(?<src>((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)).*\s(?<dest_host>www.unisystems.gr)\s(?<dest>https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|www\.[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9]\.[^\s]{2,}|www\.[a-zA-Z0-9]\.[^\s]{2,})(?<signature_desc>.*)\<(?<action>.*)\>
# APPFW_BUFFEROVERFLOW_URL
EXTRACT-src,dest_host,signature_desc,action = .*(?<function>SSLVPN|SSLLOG|APPFW|EVENT)\sAPPFW_BUFFEROVERFLOW_URL.*\s[0-9 \:]{14}(?<src>((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)).*\s(?<dest_host>www.unisystems.gr)\s(?<signature_desc>.*)\:\s(?<dest>https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|www\.[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9]\.[^\s]{2,}|www\.[a-zA-Z0-9]\.[^\s]{2,})\s\<(?<action>.*)\>
# APPFW_SQL
EXTRACT-src,dest_host,dest,signature_desc,action = .*(?<function>SSLVPN|SSLLOG|APPFW|EVENT)\sAPPFW_SQL.*\s[0-9 \:]{14}(?<src>((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)).*\s(?<dest_host>www.unisystems.gr)\s(?<dest>https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|www\.[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9]\.[^\s]{2,}|https?:\/\/(?:www\.|(?!www))[a-zA-Z0-9]\.[^\s]{2,}|www\.[a-zA-Z0-9]\.[^\s]{2,})\s(?<signature_desc>.*)\s\<(?<action>.*)\>
Do you have any clue why this is not working?
Thanks,
Andreas
Edit: The interesting part is when I go to "extract fields" option below a log line, I get all the fields extracted but I can't search them.
