I want to make a usecase that will detect the usage of several destination port numbers. For this, I think it's easiest to use a regular expression. But I'm not sure. I'm also having trouble implementing a regular expression into my query. I've never worked with them before.
Please evaluate the following information and tell me what you think is best to develop the query.
The usecase must be easy to add or remove any port numbers from, in case we want to detect other things.
The usecase must be able to detect ranges of port numbers when indicated.
Now, for what I've tried is the following:
| regex dest_port>="688[1-9]"
But this doesn't work. I will use datamodel later.
The range for the ports is:
6881 to 6889
In addition to those ports, we also want it to alert when it finds the following strings in the field app_category:
app_category field contains tracker
app_category field contains torrent
Any help would be much appreciated. I think someone with a lot of regular expression experience will be able to make the query easily, I've been stuck on it for hours sadly and I would love some help.