Splunk Search

Trendmicro Regex Help

CYBR_AH
Explorer

Hi Community,

I'm trying to figure out how to get the signature and signature id to their own fields. This has been a tricky one for me. Here is part of the _raw event:

|Trend Micro|Deep Security Agent|0.0.0000|0|Invalid Traversal|
|Trend Micro|Deep Security Agent|0.0.0000|0000000|SSL Request|

After Deep Security Agent, there is the agent version. After the agent version is the signature ID, then finally the signature. The signature ID seems to range from a single digit number to 7 digits.

I'd like to be able to get the after everything after the agent version "\d.\d.\d{0,4}" and the pipe to end on the last character of the signature before the other pipe while also breaking up the signature ID field and signature field.

Any help would be great and much appreciated.

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

... | rex "(?:[\|][^\|]*){3}\|(?<SignatureID>[^\|]*)\|(?<Signature>[^\|]*)"

View solution in original post

woodcock
Esteemed Legend

Like this:

... | rex "(?:[\|][^\|]*){3}\|(?<SignatureID>[^\|]*)\|(?<Signature>[^\|]*)"

CYBR_AH
Explorer

Thank you this also worked!

0 Karma

jplumsdaine22
Influencer

This regex also looks more efficient than mine - you should probably accept this answer instead.

0 Karma

CYBR_AH
Explorer

Ok I will. I wish I could accept both.

0 Karma

jplumsdaine22
Influencer

If you entire event is separated by | characters you should look at the csv sourcetype for automatic field extraction. Otherwise I am assuming that the string |Trend Micro|Deep Security Agent|0.0.0000|0|Invalid Traversal| occurs at the start of the line.

Try this:

<your search> ... | rex field=_raw "^(?:.*?\K\|){4}(?<signature_id>[^\|]+)\|(?<signature>[^\|]+)"

I highly recommend this website for regex help: https://regex101.com/
Also the specific solution here came from perlmonks : http://www.perlmonks.org/?node_id=721801

CYBR_AH
Explorer

Thank you!

0 Karma
Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...