Trendmicro Regex Help

[CYBR_AH]

Hi Community,

I'm trying to figure out how to get the signature and signature id to their own fields. This has been a tricky one for me. Here is part of the _raw event:

|Trend Micro|Deep Security Agent|0.0.0000|0|Invalid Traversal|
|Trend Micro|Deep Security Agent|0.0.0000|0000000|SSL Request|

After Deep Security Agent, there is the agent version. After the agent version is the signature ID, then finally the signature. The signature ID seems to range from a single digit number to 7 digits.

I'd like to be able to get the after everything after the agent version "\d.\d.\d{0,4}" and the pipe to end on the last character of the signature before the other pipe while also breaking up the signature ID field and signature field.

Any help would be great and much appreciated.

[woodcock · Accepted solution]

Like this:

... | rex "(?:[\|][^\|]*){3}\|(?<SignatureID>[^\|]*)\|(?<Signature>[^\|]*)"

[CYBR_AH]

Thank you this also worked!

[jplumsdaine22]

This regex also looks more efficient than mine - you should probably accept this answer instead.

[CYBR_AH]

Ok I will. I wish I could accept both.

[jplumsdaine22]

If you entire event is separated by | characters you should look at the csv sourcetype for automatic field extraction. Otherwise I am assuming that the string |Trend Micro|Deep Security Agent|0.0.0000|0|Invalid Traversal| occurs at the start of the line.

Try this:

<your search> ... | rex field=_raw "^(?:.*?\K\|){4}(?<signature_id>[^\|]+)\|(?<signature>[^\|]+)"

I highly recommend this website for regex help: https://regex101.com/
Also the specific solution here came from perlmonks : http://www.perlmonks.org/?node_id=721801

[CYBR_AH]

Thank you!