Within the tenable:sc:vuln sourcetype there is a particular field "PluginText" that has a value for hardware serial numbers. Overall I'm looking for any source type that provides that data, but extracting "SerialNumber" as a field from "PluginText" is frustrating. Any advice would be appreciated.
Sample Data:
pluginText: <plugin_output>
Computer Manufacturer : XXX
Computer SerialNumber : VMware- XXX
Computer Type : Other Computer
</plugin_output>
I wish to extract only the Computer Serial Number Field.
Can you explain the frustration you had when trying to extract? Assuming that pluginText is already extracted into a field, you can do something like
| spath input=pluginText ``` this gives you a field plugin_output ```
| rex field=plugin_output "Computer SerialNumber: (?<serialNumber>.+)"
Alternatively, extract all key-value pairs from plugin_output using
| spath input=pluginText ``` this gives you a field plugin_output ```
| rename _raw AS saved_raw, plugin_output AS _raw
| kv kvdelim=" : "
| rename saved_raw as _raw
Pro tip: