Sourcefire Syslog Regex Query

[MrWh1t3]

Hello,
I am trying to pull out some information from a syslog. We don't have the money to purchase a Defense Center for our Sourcefire 3DS, so as it stands right now I am only able to pull in SYSLOG information.

I have the following _raw information coming into splunk via syslog:

"Rule_Name" [Classification: Misc Activity] [Priority: 3] {TCP} source_ip:port -> destination_ip:port

Right now I have a Splunk search to do the following:

source="udp:514" host=(my ids) "Rule_Name" | rex field=_raw "Priority: (?1|2|3|4.*?)" | table Priority

This gives me a table display of each Priority number. What I would like to do, is extend this so I can see the following information in a table display:

rule_name Priority source_ip source_port destination_ip destination_port

So something like this...

xyx_rule 3 192.168.1.100 80 192.168.1.150 2045, each being their own column.

This issue I have is that I "know" all of the possibilities for Priority, but there are hundreds of possible rule combos, and that's not counting custom ones. Likewise with IP addresses, it could be any large number of IPs. Likewise with ports.

Any help would be appreciated.

[UPDATED]

Here is a bit more detail on what comes across in _raw. I filtered some of it, but this gives you a better idea.

[Default IPS Detection Engine][Initial Passive Policy _ NetworkSourcefire][1:1000002:1] "Hello_INTERNAL" [Classification: Misc Activity] [Priority: 3] {TCP} 192.168.1.10:3090 -> 192.168.2.10:28358

So far I have:

host:"192.168.1.100" |rex field=_raw "(?i)[?P[^]]+)] [(?P[^]]+)]" |table Engine, Priority

This gives me two fields and populates them correctly. I can't seem to get anything else.

v/r,

[rturk · Accepted solution]

Using your sample event I was able to make the extractions with the following regex:

sourcetype="blah" | rex "^\[(?<engine>[^]]+)\]\[(?<policy>[^]]+)\]\[(?<weird_ratio_thing>[^]]+)\] \"(?<random_quote>[^\"]+)\" \[Classification: (?<classification>[^]]+)\] \[Priority: (?<priority>[^]]+)\] {(?<protocol>[^}]+)} (?<src_ip>\d+\.\d+\.\d+\.\d+):(?<src_port>\d+) -\> (?<dst_ip>\d+\.\d+\.\d+\.\d+):(?<dst_port>\d+)"

You're welcome 😉

[MrWh1t3]

I removed the beginning ^ and it works now. Thanks!

[MrWh1t3]

Here is a bit more detail on what comes across in _raw. I filtered some of it, but this gives you a better idea.

[Default IPS Detection Engine][Initial Passive Policy _ NetworkSourcefire][1:1000002:1] "Hello_INTERNAL" [Classification: Misc Activity] [Priority: 3] {TCP} 192.168.1.10:3090 -> 192.168.2.10:28358

So far I have:

host:"192.168.1.100" |rex field=_raw "(?i)[?P[^]]+)] [(?P[^]]+)]" |table Engine, Priority

This gives me two fields and populates them correctly. I can't seem to get anything else.