REGEX Requred

[DanAlexander]

Hello Community

I need regex that can return extract the following fields only from event 4702:
1. <EventID></EventID>
2.<TimeCreated SystemTime='2024-12-05T14:59:44.9923272Z'/>

3.<Computer>Host</Computer>

4.<Data Name='TaskName'>\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask</Data>

from the following raw event:
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4702</EventID><Version>1</Version><Level>0</Level><Task>12804</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2024-12-05T14:59:44.9923272Z'/><EventRecordID>2470365</EventRecordID><Correlation ActivityID='{625186de-46eb-0000-1689-5162eb46db01}'/><Execution ProcessID='1408' ThreadID='1600'/><Channel>Security</Channel><Computer>Host</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>S-1-5-20</Data><Data Name='SubjectUserName'> Host $</Data><Data Name='SubjectDomainName'> Host </Data><Data Name='SubjectLogonId'>0x3e4</Data><Data Name='TaskName'>\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask</Data><Data Name='TaskContentNew'>&lt;?xml version="1.0" encoding="UTF-16"?&gt;
&lt;Task version="1.6" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"&gt;
&lt;RegistrationInfo&gt;
&lt;Source&gt;$(@%systemroot%\system32\sppc.dll,-200)&lt;/Source&gt;
&lt;Author&gt;$(@%systemroot%\system32\sppc.dll,-200)&lt;/Author&gt;
&lt;Version&gt;1.0&lt;/Version&gt;
&lt;Description&gt;$(@%systemroot%\system32\sppc.dll,-201)&lt;/Description&gt;
&lt;URI&gt;\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask&lt;/URI&gt;
&lt;SecurityDescriptor&gt;D:P(A;;FA;;;SY)(A;;FA;;;BA)(A;;FA;;;S-1-5-80-123231216-2592883651-3715271367-3753151631-4175906628)(A;;FR;;;S-1-5-87-2912274048-3994893941-1669128114-1310430903-1263774323)&lt;/SecurityDescriptor&gt;
&lt;/RegistrationInfo&gt;
&lt;Triggers&gt;
&lt;CalendarTrigger&gt;
&lt;StartBoundary&gt;2024-12-10T07:54:44Z&lt;/StartBoundary&gt;
&lt;Enabled&gt;true&lt;/Enabled&gt;
&lt;ScheduleByDay&gt;
&lt;DaysInterval&gt;1&lt;/DaysInterval&gt;
&lt;/ScheduleByDay&gt;
&lt;/CalendarTrigger&gt;
&lt;/Triggers&gt;
&lt;Principals&gt;
&lt;Principal id="NetworkService"&gt;
&lt;UserId&gt;S-1-5-20&lt;/UserId&gt;
&lt;RunLevel&gt;LeastPrivilege&lt;/RunLevel&gt;
&lt;/Principal&gt;
&lt;/Principals&gt;
&lt;Settings&gt;
&lt;MultipleInstancesPolicy&gt;IgnoreNew&lt;/MultipleInstancesPolicy&gt;
&lt;DisallowStartIfOnBatteries&gt;true&lt;/DisallowStartIfOnBatteries&gt;
&lt;StopIfGoingOnBatteries&gt;true&lt;/StopIfGoingOnBatteries&gt;
&lt;AllowHardTerminate&gt;false&lt;/AllowHardTerminate&gt;
&lt;StartWhenAvailable&gt;true&lt;/StartWhenAvailable&gt;
&lt;RunOnlyIfNetworkAvailable&gt;false&lt;/RunOnlyIfNetworkAvailable&gt;
&lt;IdleSettings&gt;
&lt;StopOnIdleEnd&gt;true&lt;/StopOnIdleEnd&gt;
&lt;RestartOnIdle&gt;false&lt;/RestartOnIdle&gt;
&lt;/IdleSettings&gt;
&lt;AllowStartOnDemand&gt;true&lt;/AllowStartOnDemand&gt;
&lt;Enabled&gt;true&lt;/Enabled&gt;
&lt;Hidden&gt;true&lt;/Hidden&gt;
&lt;RunOnlyIfIdle&gt;false&lt;/RunOnlyIfIdle&gt;
&lt;DisallowStartOnRemoteAppSession&gt;false&lt;/DisallowStartOnRemoteAppSession&gt;
&lt;UseUnifiedSchedulingEngine&gt;true&lt;/UseUnifiedSchedulingEngine&gt;
&lt;WakeToRun&gt;false&lt;/WakeToRun&gt;
&lt;ExecutionTimeLimit&gt;PT0S&lt;/ExecutionTimeLimit&gt;
&lt;Priority&gt;7&lt;/Priority&gt;
&lt;RestartOnFailure&gt;
&lt;Interval&gt;PT1M&lt;/Interval&gt;
&lt;Count&gt;3&lt;/Count&gt;
&lt;/RestartOnFailure&gt;
&lt;/Settings&gt;
&lt;Actions Context="NetworkService"&gt;
&lt;ComHandler&gt;
&lt;ClassId&gt;{B1AEBB5D-EAD9-4476-B375-9C3ED9F32AFC}&lt;/ClassId&gt;
&lt;Data&gt;&lt;![CDATA[timer]]&gt;&lt;/Data&gt;
&lt;/ComHandler&gt;
&lt;/Actions&gt;
&lt;/Task&gt;</Data><Data Name='ClientProcessStartKey'>26177172834095606</Data><Data Name='ClientProcessId'>2408</Data><Data Name='ParentProcessId'>1368</Data><Data Name='RpcCallClientLocality'>0</Data><Data Name='FQDN'>Host</Data></EventData></Event>

I need to be able to validate via | makeresults rex mod=sed.....

Thanks in advance

[richgalloway]

It would help to know what you've tried already and how those efforts failed to meet expectations.

Are you looking for a single regex or one for each field?

Do you plan to extract the fields at search time or index time?  If search time, have you tried using spath to parse the event?

rex mode=sed does not extract fields so it cannot be used to validate expressions.

[DanAlexander]

Hi @richgalloway, thank you for your reply.

Apologies, I should have been a bit more descriptive.

I am trying to implement a SEDCMD in transforms.conf to reduce a single raw event's size, specifically by removing elements that will never be used while keeping the event intact for compliance purposes.

My intent is not to extract fields but to ensure that only the necessary elements remain in the raw event. A single regex that can clean up the event by removing unused parts while leaving the required fields would be ideal.

Thanks in advance for your guidance!

Best regards,
D Alex

[richgalloway]

Thanks for clarifying.  Try this query.

| rex mode=sed "s:<EventID>4702<\/EventID>|<TimeCreated SystemTime='[^']+'\/>|<Computer>[^<]+<\/Computer>|<Data Name='[^']+'>[^<]+<\/Data>::g"

[DanAlexander]

Hi @richgalloway 

Thanks for your reply.

Apologies, for the delay in replying but I had to test it.

Please see the results here: https://regex101.com/r/7u6vAP/1

Now I need to figure out as I have asked @ITWhisperer how to make both work the | makeresult | rex mode=sed ........ and the props SEDCMD-reducing_4702=? to work strip the event thus reducing its weight in bytes

Thank you

[richgalloway]

Remove the ':' on the end of the regex and it should work.

You can't get | makeresults and props to work at the same time.  makeresults creates synthetic events and props only work on real events.

[ITWhisperer]

Try something like this

| rex mode=sed "s/(?ms).*(?<ei>\<EventID\>\d+\<\/EventID>).*(?<TimeCreated>\<TimeCreated SystemTime='[^']+'\/>).*(?<Computer>\<Computer\>[^\<]+\<\/Computer\>).*(?<TaskName>\<Data Name='TaskName'\>[^\<]+\<\/Data\>).*/\1\2\3\4/g"

Caveat: XML sometimes has namespace aliases either embedded or used or both which a proper XML parser would understand but these are not shown in your sample and therefore not catered for in the regex

[DanAlexander]

Hi @ITWhisperer,

Please have a look at https://regex101.com/r/wRe1Ai/1

That works in 101regex web portal, but it does not work under the makeresults and SEDCMD in props.conf

I had to remove the

(?ms).*(?<ei>\

as SEDCMD s/ would not accept it neither <ei> bit.

Can you please work out the exact SEDCMD-reducing_4702=s/........g bit that will be compatible with the SEDCMD?

Also can you try that in Splunk e.g. getting the | makeresult SPL and see if the one SPL you provide would work/remove the unwanted parts from the event?

Thank you.

[PickleRick]

For the SPL you need to escape all backslashes and quotes. For regex101 it requires you to escape slashes by default (which is not a part of the regex requirement but part of the default PHP PCRE usage syntax). SEDCMD uses raw regex.