Another regex question

[jclehmuth]

My current Regex is:

Retina: (?P'<'vuln'>\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+)\"on IP"$>
There are slashes in between the s's and w's but I can't figure that out either right now.

I'm trying to extract results similar to "Retina has found High Severity audit Microsoft Windows Authenticode Verification Code Execution (2653956)" from the following type of logs, but I only get a few results.

Nov 10 00:19:39 10.0.33.210 2014-11-10 5:19:25 Retina: Retina has found High Severity audit Microsoft Windows Authenticode Verification Code Execution (2653956) on ip 10.0.33.198.
Nov 10 00:19:47 10.0.33.210 2014-11-10 5:19:33 Retina: Retina has found Medium Severity audit Microsoft Windows Kernel Privilege Escalation (2711167) on ip 10.0.33.198.
Nov 10 00:19:41 10.0.33.210 2014-11-10 5:19:27 Retina: Retina has found High Severity audit Microsoft .NET Framework Remote Code Execution (2878890) - KB2863240 on ip 10.0.33.198.
Nov 10 00:19:30 10.0.33.210 2014-11-10 5:19:16 Retina: Retina has found Low Severity audit Microsoft VBScript/JScript Information Disclosure (2475792) - VBScript on ip 10.0.33.198.
Nov 10 00:19:48 10.0.33.210 2014-11-10 5:19:34 Retina: Retina has found Informational audit DNP3 Protocol Detected on ip 10.0.33.198.

Thanks in advance.

[aljohnson_splun · Accepted solution]

Here I've copied your logs and tested out a regex that you could use. All you need to add is the field name.

Here's the example:
http://regexr.com/39sji

So your regex will look something like this:

 Retina: (?<vuln>.+?\(\d+\)

The thing you need to do add the +? which makes the regex non-greedy, it matches the least rather than the most. Then you just go to the end of the next group of digits that are also surrounded by parenthesis.

[jclehmuth]

That seemed to work, thanks.

[rkent]

While this works, if we allow a tiny bit of pedantry, I'd revise this regex to:

Retina: (?

[jclehmuth]

I can get it to partly work when I replace the "+" with "*"