How can I use Regex to extract Windows SMB Logs?

[kleber_silva]

Hi Splunkers

I need to extract this log below each SMB Path to make a count:

LOG Example:

Here are the SMB shares available on the remote host when logged in as "user account"

• ADMIN$
• IPC$
• Teste
• Users

I need results came with below :

Action = Here are the SMB shares available on the remote host when logged in a
User = "user account"
Path = ADMIN$
Path = IPC$

Path = Teste
Path = Users

I tried using regex but I can only bring all path together.

Thanks for Help

[493669 · Accepted solution]

try this rex:
It might need some sort of modification...but at least it will give you idea...

...|rex  field=_raw "(?s).*\"\s+(?<Action>.*)as\s*(?<User>[^:]+)"|rex max_match=0 field=raw "\s*(?<Path>\w+)\$*[\r\n]\s+"

[micahkemp]

Can you include the raw event in your question? If the above represents the raw event, please use the code button (101010) to format it to make it more easy to work with.

[kleber_silva]

Following below @micahkemp thanks for help

"10395","","","None","cmp-00002","tcp","445","Microsoft Windows SMB Shares Enumeration","It is possible to enumerate remote network shares.","By connecting to the remote host, windows was able to enumerate the
network share names.","n/a","","
Here are the SMB shares available on the remote host when logged in as user.account:

• ADMIN$
• IPC$
• Teste
• Users "