The events collected from the MVM have multiline fields, I would like to extract vendor_description,vendor_observation and vendor_recommendation.
What is the best props.conf configuration?
Apr 06 2015 08:22:41
TicketID=11674520
category_id=29
vendor_category=Security Policy/Options
cve=CVE-MAP-NOMATCH
msft=
mskb=
dest_ip=196.68.23.14
dest_name=SRVUDG987
dest_host=SRVUDG987.VGR.ATTGR.NET
signature=User Rights Restore Files And Directories Policy
vendor_severity=0
vendor_description=The User Rights "Restore files and directories" policy does not match the recommended compliance value.
vendor_observation=The User Rights "Restore files and directories" policy specifies which accounts may restore files and directories from a backup.
NOTE: This check requires at least Foundstone version 4.0.6.
vendor_recommendation=Foundstone recommends the User Rights "Restore files and directories" be set via either a group policy INF file or by manually navigating to:
Control Panel - Administrative Tools - Local Security Policy - Local Policies - User Rights Assignment
Set the "Restore files and directories" policy to Administrators
Why not this straightforward rex:
vendor_description=(?<description>.*)vendor_observation=(?<observation>.*)vendor_recommendation=(?<recommendation>.*)
When I use it with the s
modifier (so that . includes newline) on your sample, I get exactly the entire text until the next vendor_ (with the first two entries at least, the last one just captures until the end of the event I guess).
have you tried it from props.conf? I have two different results between rex search command and props.conf
Unfortunately this is only rex-tested, sorry. I am not yet proficient with that sort of low-level setup. Why don't you try the expression in your props.conf, the modifier should work by prepending (?m)^
to your expression.
This works for me, but it is a bit random. Maybe you have better suggestion?
[vmdata]
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE_DATE = true
KV_MODE = none
EXTRACT-vall = (?mis)vendor_description=(?<vendor_descrition>.*)[\r\n]+vendor_observation=(?<vendor_observation>.*(?!vendor))[\r\n]+vendor_recommendation=(?<vendor_recommendation>.*)[\r\n]+