Trying again Here is a direct link https://1drv.ms/i/s!AjeD4bQcnKDim1X7MYMgE4LLAAtl ... View more

Here is a screen shot, you can see the "filepath" dir, as compared to the "file_path" which we are extracting. Some of the ones failing worked with the last extract. Not sure as to why though. ... View more

This works on some, breaks some of the ones that worked on the other. I think its how there are several message types filling in this field. Is there a way to do multiple extracts on one field, get them two different names, then combine them in a table? ... View more

Were these enough, or do I need to get some more? ... View more

rec_type=125 rec_type_simple="MALWARE EVENT" event_sec=1484593326 agent_uuid=2c57a94e-6758-4ef2-9598-dda4ba314c2a cloud="US Cloud" type=553648143 subtype=0 detector=0 detection="" agent_user="" file_name="" file_path="\\?\C:\Program Files\Sourcefire\fireAMP\Quarantine\qrt01d2702b07961b79.003" sha256=1b89b0631d931d2f8cfe42ffb0a932cf3035c79700bb8f77c2de824defe114b2 file_size=0 file_type=0 file_ts=0 parent_fname="" parent_sha256="" event_description="Detection ID: 6376279778734899202" sensor=0 instance_id=0 connection_id=77 connection_sec=1484593334 direction=0 src_ip=192.168.1.106 dest_ip=:: app_proto=0 agent_user=0 file_policy=00000000-0000-0000-0000-000000000000 disposition=0 retro_disposition=0 uri="" src_port=0 dest_port=0 src_ip_country=0 dest_ip_country=0 web_app=0 client_app=0 file_action=0 ip_proto=0 threat_score=0 num_ioc=0 rec_type=125 rec_type_simple="MALWARE EVENT" event_sec=1484593326 agent_uuid=2c57a94e-6758-4ef2-9598-dda4ba314c2a cloud="US Cloud" type=553648143 subtype=0 detector=0 detection="" agent_user="" file_name="" file_path="\?\C:\Program Files\Sourcefire\fireAMP\Quarantine\qrt01d2702b07955824.002" sha256=90f5cd7d989973f12e6c494f6e25f60ef2822d81506b209c8a431c2a76687fca file_size=0 file_type=0 file_ts=0 parent_fname="" parent_sha256="" event_description="Detection ID: 6376279778734899201" sensor=0 instance_id=0 connection_id=76 connection_sec=1484593333 direction=0 src_ip=192.168.1.106 dest_ip=:: app_proto=0 agent_user=0 file_policy=00000000-0000-0000-0000-000000000000 disposition=0 retro_disposition=0 uri="" src_port=0 dest_port=0 src_ip_country=0 dest_ip_country=0 web_app=0 client_app=0 file_action=0 ip_proto=0 threat_score=0 num_ioc=0 rec_type=125 rec_type_simple="MALWARE EVENT" event_sec=1484326304 agent_uuid=50a7aa9b-4a62-440a-bbfb-d30183df85f6 cloud="US Cloud" type=554696715 subtype=0 detector=0 detection="" agent_user="" file_name="" file_path="Flash Scan" sha256="" file_size=0 file_type=0 file_ts=0 parent_fname="" parent_sha256="" event_description="Scan ID: 193784, scanned directories: 0, scanned files: 3715, scanned processes: 111" sensor=0 instance_id=0 connection_id=71 connection_sec=1484326305 direction=0 src_ip=:: dest_ip=:: app_proto=0 agent_user=0 file_policy=00000000-0000-0000-0000-000000000000 disposition=0 retro_disposition=0 uri="" src_port=0 dest_port=0 src_ip_country=0 dest_ip_country=0 web_app=0 client_app=0 file_action=0 ip_proto=0 threat_score=0 num_ioc=0 rec_type=125 rec_type_simple="MALWARE EVENT" event_sec=1484314921 agent_uuid=09582dbf-1a4c-476a-9114-85765a6f8da1 cloud="US Cloud" type=2164260880 subtype=0 detector=0 detection="" agent_user="" file_name="" file_path="" sha256=dd21fcb1dbd5ff927b3ded134f9f7081bddf9aad6d46508cef9a4add93d7c581 file_size=0 file_type=0 file_ts=0 parent_fname="" parent_sha256="" event_description="Detection ID: 6375084042659823622, error code: 3221225524" sensor=0 instance_id=0 connection_id=67 connection_sec=1484314906 direction=0 src_ip=10.0.0.61 dest_ip=:: app_proto=0 agent_user=0 file_policy=00000000-0000-0000-0000-000000000000 disposition=0 retro_disposition=0 uri="" src_port=0 dest_port=0 src_ip_country=0 dest_ip_country=0 web_app=0 client_app=0 file_action=0 ip_proto=0 threat_score=0 num_ioc=0 rec_type=125 rec_type_simple="MALWARE EVENT" event_sec=1484314921 agent_uuid=09582dbf-1a4c-476a-9114-85765a6f8da1 cloud="US Cloud" type=553648143 subtype=0 detector=0 detection="" agent_user="" file_name="" file_path="\?\C:\Program Files\Sourcefire\fireAMP\Quarantine\qrt01d26da2d1378c61.001" sha256=dd21fcb1dbd5ff927b3ded134f9f7081bddf9aad6d46508cef9a4add93d7c581 file_size=0 file_type=0 file_ts=0 parent_fname="" parent_sha256="" event_description="Detection ID: 6375084038364856322" sensor=0 instance_id=0 connection_id=62 connection_sec=1484314905 direction=0 src_ip=10.0.0.61 dest_ip=:: app_proto=0 agent_user=0 file_policy=00000000-0000-0000-0000-000000000000 disposition=0 retro_disposition=0 uri="" src_port=0 dest_port=0 src_ip_country=0 dest_ip_country=0 web_app=0 client_app=0 file_action=0 ip_proto=0 threat_score=0 num_ioc=0 ... View more

So close. Not sure why some are not getting the correct dir. ... View more

This is my search string sourcetype=cisco:sourcefire rec_type_simple="MALWARE EVENT" | rex "file_path=.*(?P<filepath>[A-Z]:(\\\)[^\"]+)" |stats count by file_path ... View more

Nuts, I spoke too soon. Seems that some entries work while some still have \?\ in them. One that works. rec_type=125 rec_type_simple="MALWARE EVENT" event_sec=1481920232 agent_uuid=771335d1-1070-43a5-aba6-d5d2d6eb06e7 cloud="US Cloud" type=1090519054 subtype=34 detector=SHA detection=W32.A78962E3EB-100.SBX.VIOC agent_user=ejones@ZOTECNET file_name=TBNotifier.exe file_path="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" sha256=a78962e3ebde2876ba49ba646207c622e7dd4e66b0222108be06b6c49de5ab22 file_size=1928776 file_type=HTML file_ts=1478726223 parent_fname="" parent_sha256="" event_description="" sensor=0 instance_id=0 connection_id=1017 connection_sec=1481920231 direction=0 src_ip=10.0.0.118 dest_ip=:: app_proto=0 agent_user=0 file_policy=00000000-0000-0000-0000-000000000000 disposition=0 retro_disposition=0 uri="" src_port=0 dest_port=0 src_ip_country=0 dest_ip_country=0 web_app=0 client_app=0 file_action=0 ip_proto=0 threat_score=0 num_ioc=0 Example of one that failed. rec_type=125 rec_type_simple="MALWARE EVENT" event_sec=1481920232 agent_uuid=771335d1-1070-43a5-aba6-d5d2d6eb06e7 cloud="US Cloud" type=1090519054 subtype=Execute detector=SHA detection=W32.A78962E3EB-100.SBX.VIOC agent_user="SYSTEM@NT AUTHORITY" file_name=TBNotifier.exe file_path="\?\C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" sha256=a78962e3ebde2876ba49ba646207c622e7dd4e66b0222108be06b6c49de5ab22 file_size=1928776 file_type=HTML file_ts=1478726223 parent_fname=apnmcp.exe parent_sha256=b69749726c16e54fc2ec448748dba5136c412ee5a70443b559db89406ba811cb event_description="" sensor=0 instance_id=0 connection_id=1016 connection_sec=1481920231 direction=0 src_ip=10.0.0.118 dest_ip=:: app_proto=0 agent_user=0 file_policy=00000000-0000-0000-0000-000000000000 disposition=0 retro_disposition=0 uri="" src_port=0 dest_port=0 src_ip_country=0 dest_ip_country=0 web_app=0 client_app=0 file_action=0 ip_proto=0 threat_score=0 num_ioc=0 Is it possible for one regex to do both? If not, can I have two extracts with the same name for the sourcetype? ... View more

Okay, did not think about that button. Get an error when I try to paste that into the Extraction field. "Encountered the following error while trying to update: Regex: missing closing parenthesis" Not seeing any missing though ... View more

That worked perfectly on a search. To convert it to a field extraction, would this be correct? file_path:"file_path=.*(?P[A-Z]:(\)[^\"]+)" ... View more

somesoni2, Any suggestions with how to adjust for the (x86) issue? Thanks ... View more

Here is the raw, where the (x86) is at. rec_type=125 rec_type_simple="MALWARE EVENT" event_sec=1481920232 agent_uuid=771335d1-1070-43a5-aba6-d5d2d6eb06e7 cloud="US Cloud" type=1090519054 subtype=34 detector=SHA detection=W32.A78962E3EB-100.SBX.VIOC agent_user=ejones@ZOTECNET file_name=TBNotifier.exe file_path="C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" sha256=a78962e3ebde2876ba49ba646207c622e7dd4e66b0222108be06b6c49de5ab22 file_size=1928776 file_type=HTML file_ts=1478726223 parent_fname="" parent_sha256="" event_description="" sensor=0 instance_id=0 connection_id=1017 connection_sec=1481920231 direction=0 src_ip=10.0.0.118 dest_ip=:: app_proto=0 agent_user=0 file_policy=00000000-0000-0000-0000-000000000000 disposition=0 retro_disposition=0 uri="" src_port=0 dest_port=0 src_ip_country=0 dest_ip_country=0 web_app=0 client_app=0 file_action=0 ip_proto=0 threat_score=0 num_ioc=0 Here is what it shows. file_path C:\Program Files Thanks ... View more

Oh noticed one thing when testing, which I am not sure about. In some directories, you get (x86) for example. While your rex was perfect for the rest, it dropped that. Testing to get it back, when its there, did not work. Is that due to the () ? Is it a rex issue? ... View more

Okay, this works perfect on a search time regex. When I try to make it a field extract, I get "Encountered the following error while trying to update: Regex: missing closing parenthesis" I do not see where one is missing. I was pasting it into my existing file_path extract like this. file_path=.+(?P[A-Z]:(\)[A-z0-9._\s-]+) ... View more

I was thinking about the permissions for precanned dashboard panels. Concern was about the ones I created. The field extractions are different with some of the apps, hence my separating them previously. If I still share them, would that conflict in the search app as it would when they were in the same app? (sorry this is a new area in dashboard creation for me). ... View more

Figured out how to change my query for the Marker. Your comment got me thinking. Thank you. For the single value, the comparison of yesterday to today seems to be where I am missing something. This is the search I am using, granted it gives me everything, not just the top 10, but I can live with that. index=location |search LockedStatus=Locked |rename UserAccountEntry as User |stats count as total ... View more

Thank you, I will try that. Is there a way I could sum the total and use that as my number? ... View more

I think I have it now, had to go find another example. I was running into a name error. Thank you for the suggestion. ... View more

So the Locked status field is called Status. The Login status is called Loginstatus. With that said, would this be the correct search? index=Account Status=Locked OR LoginStatus=Login | stats latest(_time) as time by Status | where isnotnull(Locked) AND Login ... View more

Okay, so I can create a report to run every hour, and update the CSV with the User names that have failed to login. That part I understand. Still a little foggy on how to use that lookup table for my search to pull usernames for. Using this search, index=Account Status=Locked | table LoginTime, LoginStatus, FailureReason, Status, UserID, how to I feed the look up into it? ... View more