Local Processes Tracker lookup localprocesses_tracker issue with spaces in process name/path

[vvanlier]

The "Local Processes Tracker"  from SA-EndpointProtection maintains a list of all processes on each system and the first and last time they were seen in localprocesses_tracker lookup.
The lookup gen search cut the process command after the first space.

| rex field=process "^\s*(?<process>[^\s]+)"

In case of Windows system, it mean for instance that all the processes started from a subfolder of C:\Program Files (x86) like "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" are seen as process "C:\Program in the lookup. And they are many other processes with space in the path that have a similar problem.
Would it be possible to improve the regular expression in that search to take in account strings with spaces between quotes?

[vvanlier]

FYI I followed your advise and opened a case to the support.

[masonreed11]

Good catch. The current regex truncates quoted Windows paths at the first space, so supporting quoted strings would make the process extraction much more accurate. This would be a useful enhancement to raise with the maintainers.

[livehybrid]

Hi @vvanlier 

Given that this is part of the Enterprise Security app/ecosystem, I would recommend opening a support case with Splunk for them to look into this as its unlikely to be picked up as a community post and we're not able to influence them directly.

Once you have raised with Splunk via support they should be able to assign it to the relevant internal team.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful

• Marking it as the solution if it resolved your issue

• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.