How to obtain a variable for string value in a field?

[Stephen11]

Need some help ...  I looked at several examples but not that straight forward ...  The rex and split functions were my best bet ... never got anything ... that really worked well. The split function only gave me the first part.  The rex function did not get me a variable assignment.

I need to be able to get a variable -- preferably through the eval function that captures the sid # in a variable like mySid.   See the sample string below.  I just need the # which in the example below which is 2008518.  The Sid # is going to be in the text string in different locations- i.e not the same exact absolute location in the string.  Appreciate the help!!! 🙂

Example - String 

A suspicious packet was sent [sid:2008518] -- Detected an attempt to make a configuration change in SQL DB using the legit 'sp_configure' command The xp_cmdshell option is a SQL Server server configuration option that enables system administrators to control whether the xp_cmdshell extended stored procedure can be executed on a system. By default, the xp_cmdshell option is disabled on new installations. Before enabling this option, it is important to consider the potential security implications associated with the use of this option. It is proposed to disable the xp_cmdhsell option.

[gcusello]

Hi @Stephen11,

to extract the sid, you have to use the rex command using a regex like this:

\[sid:(?<sid>[^\]]*)\]

that you can test at https://regex101.com/r/DljBHu/1

You can use this regex in a rex command

your_search
| rex "\[sid:(?<sid>[^\]]*)\]"
| table ...

or in a field extraction [Settings -- Fields -- Field Extractions -- New Field Extration].

Ciao.

Giuseppe