Hi all!
I'm looking to extract certain values from a Linux command line. Take the following example
| makeresults
| eval sampleCLI="find / -perm -664 -type d 2>/dev/null"
| eval sampleCLI2="find . -perm -2 -type d 2>/dev/null"
| eval sampleCLI3="find . \( -perm -o rwx \) -type d 2>/dev/null"
| eval sampleCLI4="find / -perm -o+w"
What I want is to extract the permissions and run some checks on it. For example, 664, 2, rwx and +w respectively in the above example. I'm having a hard type writing the regex query for this. I'm new to this and was trying to keep it simple and just get the value using negative matching like so
| rex field=sampleCLI* “find * -perm (?<permval>\S+)”
However the rex command doesn't even run. Throws up the following error: Error in 'rex' command: The regex '“find' does not extract anything. It should specify at least one named group. Format: (?<name>...).
Could someone please explain where I'm going wrong? Thanks very much!
| rex field=yourfield "-perm(\s-o)?\s?(-|\+)?(?<permission>[^\s]+)"
you can't use wildcard (*) in rex field attribute.
| rex field=sampleCLI "-perm\s+-(-0)?(?<permission>[^\s]+)"
| rex field=sampleCLI2 "-perm\s+-(-0)?(?<permission>[^\s]+)"
Thank you, this is great. However, it does not match for commands like
find / -perm -o+w
find . \( -perm -o rwx \) -type d 2>/dev/null
Is it possible for the same regex expression to have this?
| rex field=yourfield "-perm(\s-o)?\s?(-|\+)?(?<permission>[^\s]+)"