Hi, everyone.
Need some help for detection exclusion setting.
Want to exclude detections of the files which are applicable to the file path below.
c:\users\01234567\downloads\1234567890123xx.exe
For preventing alerts, I would like to use "13 digits number" and "xx.exe" as indicators.
For now, I found it can be excluded only by "xx.exe."
ex) file_path="*xx.exe"
Although, when I use regex like below, it doesn't work.
ex) file_path="*\d{13}xx.exe"
Could you please let me know how to set both "13 digits number" and "xx.exe" as indicators for excluding detections?
Hi @Ange,
if you are not sure about the number of digits (like in your example) you could use something like this:
<your_search>
| rex "(?<file>\d+xx\.exe)$"
| search NOT file=*
| ...
If instead you're sure about the number of digits (17), you could use something like this:
<your_search>
| rex "(?<file>\d{17}xx\.exe)$"
| search NOT file=*
| ...
Ciao.
Giuseppe
@gcusello
I checked with below and now it works correctly
| regex file_path="\d{13}xx.exe"
Thank you very much for your great support!
Hi @Ange,
good for you, see next time!
Please accept one answer for the other people of Community
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated 😉
@gcusello
Thank you for your reply and support!
The number of digits are always 13, so I checked with the second one like below.
| rex "(?<file>\d{13}xx\.exe)$"
| search NOT file=*
| start count by file
| sort - count
Although it couldn't work accurately.
In addition, just in case, I checked like this.
| rex "(?<file>\d\d\d\d\d\d\d\d\d\d\d\d\dxx\.exe)$"
| search NOT file=*
| start count by file
| sort - count
But the result was the same.
It seems "\d" is not working correctly on my computer.
Hi @Ange,
It's very strange because it's a standard regex operator.
Anyway, what do you mean saying: "It seems "\d" is not working correctly on my computer.", what's the not correct result you're receiving?
is it wrong every time or sometimes is it correct?
Ciao.
Giuseppe
Hi @Ange,
if you are not sure about the number of digits (like in your example) you could use something like this:
<your_search>
| rex "(?<file>\d+xx\.exe)$"
| search NOT file=*
| ...
If instead you're sure about the number of digits (17), you could use something like this:
<your_search>
| rex "(?<file>\d{17}xx\.exe)$"
| search NOT file=*
| ...
Ciao.
Giuseppe