The events collected from the MVM have multiline fields, I would like to extract vendor_description,vendor_observation and vendor_recommendation.
What is the best props.conf configuration?
Apr 06 2015 08:22:41 TicketID=11674520 category_id=29 vendor_category=Security Policy/Options cve=CVE-MAP-NOMATCH msft= mskb= dest_ip=220.127.116.11 dest_name=SRVUDG987 dest_host=SRVUDG987.VGR.ATTGR.NET signature=User Rights Restore Files And Directories Policy vendor_severity=0 vendor_description=The User Rights "Restore files and directories" policy does not match the recommended compliance value. vendor_observation=The User Rights "Restore files and directories" policy specifies which accounts may restore files and directories from a backup. NOTE: This check requires at least Foundstone version 4.0.6. vendor_recommendation=Foundstone recommends the User Rights "Restore files and directories" be set via either a group policy INF file or by manually navigating to: Control Panel - Administrative Tools - Local Security Policy - Local Policies - User Rights Assignment Set the "Restore files and directories" policy to Administrators
Why not this straightforward rex:
When I use it with the
s modifier (so that . includes newline) on your sample, I get exactly the entire text until the next vendor_ (with the first two entries at least, the last one just captures until the end of the event I guess).
Unfortunately this is only rex-tested, sorry. I am not yet proficient with that sort of low-level setup. Why don't you try the expression in your props.conf, the modifier should work by prepending
(?m)^ to your expression.
This works for me, but it is a bit random. Maybe you have better suggestion?
[vmdata] SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE_DATE = true KV_MODE = none EXTRACT-vall = (?mis)vendor_description=(?<vendor_descrition>.*)[\r\n]+vendor_observation=(?<vendor_observation>.*(?!vendor))[\r\n]+vendor_recommendation=(?<vendor_recommendation>.*)[\r\n]+