Hi, I have the following case which I can't get around.
My search returns something like this:
In order to help security analysts with some useful information, from a lookup we are adding MITRE technique ID and some useful information about how to detect this particular technique.
What I wanted to do is to move the multivalue fields from mitre_technique_id column as the separate columns named exactly like the MITRE ID, and in that column I wanted to include the information about the detection tips for that technique.
I was trying something with foreach, transpose, mvexpand but with no good results.
Does anyone knows how to achieve it? The end result would look like this:
Thanks in advance!
| streamstats count as row
| eval iddetect=mvzip(mitre_technique_id,mitre_detection,"|")
| mvexpand iddetect
| rex field=iddetect "(?<_name>[^\|]+)\|(?<_value>.+)"
| eval {_name}=_value
| fields - iddetect mitre_technique_id mitre_detection
| stats values(*) as * by row
| fields - row
Give this a try
YOur current search giving field host, dest, user, mitre_technique_id mitre_detection
| eval iddetect=mvzip(mitre_technique_id,mitre_detection,"|")
| mvexpand iddetect
| rex field=iddetect "(?<mitre_technique_id>[^\|]+)\|(?<mitre_detection>.+)"
| fields - iddetect
| eval common_key=host."##".dest."##".user
| xyseries common_key mitre_technique_id mitre_detection
| rex field=common_key "(?<host>[^#]+)##(?<dest>.+)##(?<user>.+)"
| fields - common_key
| table host dest user *
| streamstats count as row
| eval iddetect=mvzip(mitre_technique_id,mitre_detection,"|")
| mvexpand iddetect
| rex field=iddetect "(?<_name>[^\|]+)\|(?<_value>.+)"
| eval {_name}=_value
| fields - iddetect mitre_technique_id mitre_detection
| stats values(*) as * by row
| fields - row
Solved by adding (?s) in front of the regex.
Thanks, I see the light in the tunnel 🙂
How to modify that regex so it captures remaining lines of the paragraph?
Try this
| rex field=iddetect "(?ms)(?<_name>[^\|]+)\|(?<_value>.+)"