Hi i would like a help on our current problem. We have this JSON log that we only need to ingest the events that satisfy the following condition. FolderPath = "*windows*" AND FolderPath="*personal...
See more...
Hi i would like a help on our current problem. We have this JSON log that we only need to ingest the events that satisfy the following condition. FolderPath = "*windows*" AND FolderPath="*personal*" AND InitiatingProcessSHA1="bbcc123448781q40410bcd6f0a2cc666b52e7abc" (FileName = "*vendor.exe*" OR FileName = "*stellar.exe*") AND InitiatingProcessFileName = "Setup64.exe" {
"AccountName": "jcn001",
"AccountSid": "",
"ActionType": "ProcessCreated",
"DeviceName": "windowhost",
"EventCount": 1,
"FileName": "Code Helper vendor.exe",
"FolderPath": "/private/var/folders/d6/windows/AppTranslocation/personal/d/",
"InitiatingProcessCommandLine": "tasklist sample",
"InitiatingProcessFileName": "Setup6.exe,
"InitiatingProcessFolderPath": "/private/var/folders/d6/test/t/apptranslocation/test/d/visual studio code.app",
"InitiatingProcessParentFileName": "Setup64.exe",
"InitiatingProcessSHA1": "bbcc123448781q40410bcd6f0a2cc666b52e7abc",
"ProcessCommandLine": "tasklist jade /svc",
"SHA1": "bbcc123448781q40410bcd6f0a2cc666b52e7abc",
"SHA256": "none",
"Timestamp": "2021-01-22T20:11:42.103861Z"
}
{
"AccountName": "jcn001",
"AccountSid": "",
"ActionType": "ProcessComplete",
"DeviceName": "windowhost,
"EventCount": 1,
"FileName": "Code Helper stellar.exe",
"FolderPath": "/private/var/folders/d6/windows/AppTranslocation/personal/d/",
"InitiatingProcessCommandLine": "sample",
"InitiatingProcessFileName": "Code Helper (Renderer)",
"InitiatingProcessFolderPath": "/private/var/folders/d6/sample/t/apptranslocation",
"InitiatingProcessParentFileName": "Code Helper (Renderer)",
"InitiatingProcessSHA1": "bbcc123448781q40410bcd6f0a2cc666b52e7abc",
"ProcessCommandLine": "\"tasklist jade /svc ",
"SHA1": "bbcc123448781q40410bcd6f0a2cc666b52e7abc",
"SHA256": "none",
"Timestamp": "2021-01-22T20:11:42.103861Z"
}
{
"AccountName": "jcn001",
"AccountSid": "",
"ActionType": "Done",
"DeviceName": "windowhost",
"EventCount": 1,
"FileName": "Code Helper reg.exe",
"FolderPath": "/private/var/folders/d6/windows/AppTranslocation/company/d/",
"InitiatingProcessCommandLine": "sample",
"InitiatingProcessFileName": "Code Helper (Renderer)",
"InitiatingProcessFolderPath": "/private/var/folders/d6/word/",
"InitiatingProcessParentFileName": "Code Helper (Renderer)",
"InitiatingProcessSHA1": "bbcc123448781q40410bcd6f0a2cc666b52e7abc",
"ProcessCommandLine": "\"tasklist jade /svc ",
"SHA1": "bbcc123448781q40410bcd6f0a2cc666b52e7abc",
"SHA256": "none",
"Timestamp": "2021-01-22T20:11:42.103861Z"
} In the example - the only one that will be ingested is the first log. NOW, the client want us to put the condition onto a REGEX format, so they could put it on configuration file. Is there are way to achieve it ? Converting query to regex with conditions