Hi,
We receive daily emails with lists of IOC's for malware and phishing alerts, each email may contain multiple ip address, domains and email addresses and we are trying to extract these to run searches against out web and email logs.
I have the regex working for extraction but it will only extract the first match.
I've tried multiple ways of achieving this without success, the current config is:
Props.conf
EXTRACT-IOCURL = (?P<IOCURL>[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9][\[][\.|@][\]][^\s]{2,}|[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9][\[][\.|@][\]][^\s]{2,}|[a-zA-Z0-9]+[\[][\.|@][\]][^\s]{2,}|[a-zA-Z0-9]+[\[][\.|@][\]][^\s]{2,})
EXTRACT-IOCIP = (?P<IOCIP>\d{1,3}\[\.\]\d{1,3}\[\.\]\d{1,3}\[\.\]\d{1,3}+)
The indexed email looks like this....
....
Domains
comprised[.]site
badsite[.]studio
malware[.]live
IP addresses
192[.]254[.]71[.]78
192[.]71[.]27[.]202
193[.]182[.]144[.]67
....
but the current config will only extract the first record for each:
IOCURL - comprised[.]site
and
IOCIP - 192[.]254[.]71[.]78.
Any ideas how to extract all the domains and IP addresses?
Thanks
