Splunk Search

Extract the CVE value

rashid47010
Communicator

From IPS Event How can I extract only CVE value

XXXXDxxxre xxxrability (CVE-201x-00xx) (severity = Low)

I am writing:
rex "CVE-(?\d+\d+)"

but no event apprears

Tags (2)
0 Karma

karimcisco
New Member

If you are using the TA Tenable do you need to create a props.conf file under and put the regex described by Giuseppe?

local karim$ pwd
/Applications/Splunk/etc/apps/Splunk_TA_nessus/local
local karim $ ls
inputs.conf

215:local karim $ more inputs.conf
[monitor:///Applications/Splunk/etc/apps/Splunk_TA_nessus/spool]
disabled = false
host = 127.0.0.1
sourcetype = CVE_2017

please advise

Thanks
Karim

0 Karma

woodcock
Esteemed Legend

Try this:

... | rex "CVE-(?<CVE>[^)]+)"
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi rashid47010,
try

\(CVE-(?<CVE>[^\)]*)\)

you can sse in https://regex101.com/r/Pmk72R/1

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...