Regex for CEF

[pavanbmishra]

Hi SMEs,

I am trying to write regex to parse/map CEF format fields as below. so that all corresponding fieldname can capture values, i am not able to capture values having spaces in between. Seeking suggestion. Attached snap shot for ref.

regex101

c[n|s]\dlabel\=(\w+).*?c[n|s]\d\=([\.a-zA-Z0-9_-]+)

CEF:0|vendor|product|1.1|1234|PolicyAssetUpdated|1|cn1label=EventUserId cn1=-3 cs1label=EventUserDisplayName cs1=Automated System cs2label=EventUserDomainName cs2= cn2label=AssetId cn2=20888 cs3label=AssetName cs3=ABCDPQRS.domain.com cn3label=DirectoryId cn3=856 cs4label=DirectoryName cs4=Active Directory cs5label=DomainName cs5=domain.com

[pavanbmishra]

Thanks johnhua,

Could you please suggest me how this can be called out in props.conf & transforms.conf please

[johnhuang]

Bunch of different ways. Here's one:

| makeresults
| eval _raw="CEF:0|vendor|product|1.1|1234|PolicyAssetUpdated|1|cn1label=EventUserId cn1=-3 cs1label=EventUserDisplayName cs1=Automated System cs2label=EventUserDomainName cs2= cn2label=AssetId cn2=20888 cs3label=AssetName cs3=ABCDPQRS.domain.com cn3label=DirectoryId cn3=856 cs4label=DirectoryName cs4=Active Directory cs5label=DomainName cs5=domain.com"
| rex field=_raw "^.*?\|(?<_raw>cn1label.*)"
| rex field=_raw mode=sed "s/\s?c[n|s]\d+label\=/;/g"
| rex field=_raw mode=sed "s/\s?c[n|s]\d+\=/:/g"
| extract pairdelim=";",kvdelim=":"
| table AssetId AssetName DirectoryId DirectoryName DomainName EventUserId EventUserDisplayName EventUserDomainName