Splunk Search

Trendmicro Regex Help

CYBR_AH
Explorer

Hi Community,

I'm trying to figure out how to get the signature and signature id to their own fields. This has been a tricky one for me. Here is part of the _raw event:

|Trend Micro|Deep Security Agent|0.0.0000|0|Invalid Traversal|
|Trend Micro|Deep Security Agent|0.0.0000|0000000|SSL Request|

After Deep Security Agent, there is the agent version. After the agent version is the signature ID, then finally the signature. The signature ID seems to range from a single digit number to 7 digits.

I'd like to be able to get the after everything after the agent version "\d.\d.\d{0,4}" and the pipe to end on the last character of the signature before the other pipe while also breaking up the signature ID field and signature field.

Any help would be great and much appreciated.

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

... | rex "(?:[\|][^\|]*){3}\|(?<SignatureID>[^\|]*)\|(?<Signature>[^\|]*)"

View solution in original post

woodcock
Esteemed Legend

Like this:

... | rex "(?:[\|][^\|]*){3}\|(?<SignatureID>[^\|]*)\|(?<Signature>[^\|]*)"

CYBR_AH
Explorer

Thank you this also worked!

0 Karma

jplumsdaine22
Influencer

This regex also looks more efficient than mine - you should probably accept this answer instead.

0 Karma

CYBR_AH
Explorer

Ok I will. I wish I could accept both.

0 Karma

jplumsdaine22
Influencer

If you entire event is separated by | characters you should look at the csv sourcetype for automatic field extraction. Otherwise I am assuming that the string |Trend Micro|Deep Security Agent|0.0.0000|0|Invalid Traversal| occurs at the start of the line.

Try this:

<your search> ... | rex field=_raw "^(?:.*?\K\|){4}(?<signature_id>[^\|]+)\|(?<signature>[^\|]+)"

I highly recommend this website for regex help: https://regex101.com/
Also the specific solution here came from perlmonks : http://www.perlmonks.org/?node_id=721801

CYBR_AH
Explorer

Thank you!

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...