Query events matched a value in lookup csv (regex)

[lnn2204]

Hi, I had this csv list

command_Rex	comment_remark
*uname -a	malicious
*arp*	malicious
*tcpdump*	malicious

I want to search for events (it had data.command field that hold the command executed in linux server)

How can I search and filter out those event matched 1 of those regex in the list?

[bowesmana · Accepted solution]

If you have that CSV file, then you should create a lookup DEFINITION that is using that CSV - then make the advanced option 

WILDCARD(command_Rex)

and then in your SPL

| lookup definition_name command_Rex as data.command OUTPUT comment_remark

This assumes that your event field 'data.command' that contains a string that is to be matched against the command_Rex, which contains wildcards - so this will do a wildcard match - NOT a regex.

[lnn2204]

in my csv file, I have this to check

*\.sh

test

tried your suggestion, but I the comment_remark wasn't added to the events, I had a lot of events run .sh file

[lnn2204]

I understood why it happened. Thank you a lot