Correct RegEx depicted as Syntax Error

Graylog Central (peer support)
1

I’ve just found some error messages in my logs caused by a (automatically translated) sigma rule which contains the following search string, showing an error message:
(ParentImage:/c\:\\windows\\temp\\/) AND (Image:/c\:\\windows\\temp\\helper\\.*/)
This is however correct syntax and should also be correct Graylog syntax. The following works without any issues:
(ParentImage:/c\:\\windows\\temp/) AND (Image:/c\:\\windows\\temp\\helper\\.*/) (notice the missing \\ at the end of the first regex string).

I understand that it would be way more efficient not to use regex here but I was interested in what causes this issue. Any ideas?

2

hello @dmuensterer

Can you post the full error message and/or messages from this issue? And versions of Graylog/ES or Mongo would help.

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.