Splunk Search

Extraction of Multiple events (URLS and IP addresses) from text files

capilarity
Path Finder

Hi,

We receive daily emails with lists of IOC's for malware and phishing alerts, each email may contain multiple ip address, domains and email addresses and we are trying to extract these to run searches against out web and email logs. 

I have the regex working for extraction but it will only extract the first match.

I've tried multiple ways of achieving this without success, the current config is:

Props.conf

EXTRACT-IOCURL = (?P<IOCURL>[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9][\[][\.|@][\]][^\s]{2,}|[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9][\[][\.|@][\]][^\s]{2,}|[a-zA-Z0-9]+[\[][\.|@][\]][^\s]{2,}|[a-zA-Z0-9]+[\[][\.|@][\]][^\s]{2,})

EXTRACT-IOCIP = (?P<IOCIP>\d{1,3}\[\.\]\d{1,3}\[\.\]\d{1,3}\[\.\]\d{1,3}+)


The indexed email looks like this....

....

Domains
comprised[.]site
badsite[.]studio
malware[.]live

IP addresses
192[.]254[.]71[.]78
192[.]71[.]27[.]202
193[.]182[.]144[.]67 

....

 

but the current config will only extract the first record for each:

IOCURL - comprised[.]site

and 

IOCIP  - 192[.]254[.]71[.]78.

Any ideas how to extract all the domains and IP addresses?

Thanks 

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

one way is move this to transforms.conf and use MV_ADD = 1 like in e.g. this https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-field-that-appears-several-times-but-...

r. Ismo

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...