Splunk Search

Extraction of Multiple events (URLS and IP addresses) from text files

capilarity
Path Finder

Hi,

We receive daily emails with lists of IOC's for malware and phishing alerts, each email may contain multiple ip address, domains and email addresses and we are trying to extract these to run searches against out web and email logs. 

I have the regex working for extraction but it will only extract the first match.

I've tried multiple ways of achieving this without success, the current config is:

Props.conf

EXTRACT-IOCURL = (?P<IOCURL>[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9][\[][\.|@][\]][^\s]{2,}|[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9][\[][\.|@][\]][^\s]{2,}|[a-zA-Z0-9]+[\[][\.|@][\]][^\s]{2,}|[a-zA-Z0-9]+[\[][\.|@][\]][^\s]{2,})

EXTRACT-IOCIP = (?P<IOCIP>\d{1,3}\[\.\]\d{1,3}\[\.\]\d{1,3}\[\.\]\d{1,3}+)


The indexed email looks like this....

....

Domains
comprised[.]site
badsite[.]studio
malware[.]live

IP addresses
192[.]254[.]71[.]78
192[.]71[.]27[.]202
193[.]182[.]144[.]67 

....

 

but the current config will only extract the first record for each:

IOCURL - comprised[.]site

and 

IOCIP  - 192[.]254[.]71[.]78.

Any ideas how to extract all the domains and IP addresses?

Thanks 

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

one way is move this to transforms.conf and use MV_ADD = 1 like in e.g. this https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-field-that-appears-several-times-but-...

r. Ismo

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...