Local Processes Tracker lookup localprocesses_tracker issue with spaces in process name/path

[vvanlier]

The "Local Processes Tracker"  from SA-EndpointProtection maintains a list of all processes on each system and the first and last time they were seen in localprocesses_tracker lookup.
The lookup gen search cut the process command after the first space.

| rex field=process "^\s*(?<process>[^\s]+)"

In case of Windows system, it mean for instance that all the processes started from a subfolder of C:\Program Files (x86) like "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" are seen as process "C:\Program in the lookup. And they are many other processes with space in the path that have a similar problem.
Would it be possible to improve the regular expression in that search to take in account strings with spaces between quotes?

[jasonmiller11tt]

I agree this looks like a limitation of the current regex. Updating it to handle quoted paths would correctly capture Windows executables located under folders like Program Files and improve the accuracy of the localprocesses tracker lookup. It's a reasonable enhancement request.

[vvanlier]

FYI I followed your advise and opened a case to the support.

[masonreed11]

Good catch. The current regex truncates quoted Windows paths at the first space, so supporting quoted strings would make the process extraction much more accurate. This would be a useful enhancement to raise with the maintainers.

[livehybrid]

Hi @vvanlier 

Given that this is part of the Enterprise Security app/ecosystem, I would recommend opening a support case with Splunk for them to look into this as its unlikely to be picked up as a community post and we're not able to influence them directly.

Once you have raised with Splunk via support they should be able to assign it to the relevant internal team.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful

• Marking it as the solution if it resolved your issue

• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.