Functions not working

$message is a reference to the currently processed message and you can access any message field via that reference:

$message.foobar // Message field "foobar"
$message.`foo-baz` // Message field "foo-baz"

Hi Jochen,

In my function i had this

when
// detects powershell executing from Excel
has_field(“sysmon_event_id”) AND
has_field(“sysmon_data_process”) AND
has_field(“sysmon_cmd_parent_file”) AND
contains(“1”,to_string($message.sysmon_event_id)) AND
contains(“C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe”, to_string($message.sysmon_data_process)) AND
contains(“EXCEL.EXE”, to_string($message.sysmon_cmd_parent_file))
then
set_field(“Ref”, “T1090”);

end

Now I know that the fields are present because if i do something like

when
has_field(“CustomerID”) AND contains(to_string($message.Channel), “Microsoft-Windows-Sysmon”)
then
let debug_message = concat("Field present ", to_string($message.sysmon_cmd_parent_file));
debug(debug_message);
let debug_message2 = concat("Field present ", to_string($message.sysmon_data_process));
debug(debug_message2);
let debug_message3 = concat("Field present ", to_string($message.sysmon_event_id));
debug(debug_message3);
end

I get the following

So why doesn’t the above trigger? The pipeline stage is set to at least one rule must be matched and there are three rules in total. One of them is the very specific one that you help me create the other day.

Cheers

Jake

Because neither message fulfills the condition in the when clause of your rule.

Hi Jochen,

Forgive my lack of understanding. If I look at below, i think it should match

sysmon-1

I am assuming that EXCEL.exe would match sysmon_cmd_parent_file field unless contains is an explicit match.

Cheers

Jake

Hi Jochen,

I have confirmed that “contains” requires an explicit match. Is there a way to get it to match on part of a string?

Cheers

Jake

The contains() function does not require an exact match of the complete string.

contains(value: string, search: string, [ignore_case: boolean])

Checks if value contains search, optionally ignoring the case of the search pattern.

Hi Jochen,

It worked when I change it to the full path, but doesn’t work when i set to excel.exe or EXCEL.EXE.

I wonder if this is the reason why

contains(“C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE”, to_string($message.sysmon_cmd_parent_file))

Notice the space between Microsoft and Office could this cause the match to be terminated and so it never matches?

Cheers

Jake

The strings in the pipeline rule language are basically Java strings ().
This means that back slashes have to be escaped ( "\""\\").

For example, the following function call returns true:

contains("Foo Bar\\Baz", "Bar\\Baz");

EDIT: Maybe you should check the argument order for the contains() function in your pipeline rule. :wink:

No, the contains() function doesn’t handle whitespace characters any different than other characters.

Hi Jochen,

so why does it not match then?

If we have the string “C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE” it should match on either excel.exe or EXCEL.EXE?

How can the argument order be wrong if matches on the full path?

Unless, I am being very silly here :frowning:

Does it have to match the order of appearance in the log file?

Did you do this? :wink:

Just think about in which case the contains() function would return true, even if the argument order is wrong. :roll_eyes:

Hi Jochen,

How should the order be:

has_field(“field-x”) AND
has_field(“field-y”) AND
has_field(“field-z”) AND
contains(“match for x”,to_string($message.field-x)) AND
contains(“match for y”, to_string($message.field-y)) AND
contains(“match for z", to_string($message.field-z))

or is it meant to be

has_field(“field-x”) AND
has_field(“field-y”) AND
has_field(“field-z”) AND
contains(“match for x”,to_string($message.field-z)) AND
contains(“match for y”, to_string($message.field-y)) AND
contains(“match for z", to_string($message.field-x))

Cheers

Jake

The order of the function calls doesn’t matter (at least not in your case). The order of arguments in the contains() function does matter, though.

Hi Jochen,

How do I determine the order that the contains statements should be in? I got my last example wrong.

With below:

has_field(“field-x”) AND
has_field(“field-y”) AND
has_field(“field-z”) AND
contains(“match for x”,to_string($message.field-x)) AND
contains(“match for y”, to_string($message.field-y)) AND
contains(“match for z", to_string($message.field-z))

I would expect that fields x,y,and z need to be present or there is no match. The three fields with the contain statement must also match i.e field-x = “match for x” and field-y =“match for y” and field-z= “match for z”.

Anyone of the six conditions ( 3 x has field or a non field match) results in a negative result.

Do the has_field and condition statement need to be in the same order as the fields in the log?

How does the contains order work? Could you please point me to some other documentation?

Cheers

Jake

You’re chasing the wrong thing.

Take a step back, then read the documentation of the contains() function at http://docs.graylog.org/en/2.4/pages/pipelines/functions.html#contains, with special attention to the function signature (its name and the parameters the function takes).

Hi Jochen,

The documentation says the following

contains(value: string, search: string, [ignore_case: boolean])

Checks if value contains search, optionally ignoring the case of the search pattern.

So this would mean a contains statement should be

contains(to_string($message.sysmon_cmd_parent_file,“EXCEL.EXE”))

This would search for the “EXCEL.EXE” within the string of the field message.sysmon_cmd_parent_file ie “C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE” with the option to ignore case

This makes sense, however it is in oppostion to my earlier conversation with Jan here at Checking condition in a pipeline

I think I have figured it out.

In the example above the strings are searching for identical matches as the fields can only contain “11” for sysmon_event_id so the order does not matter, where as in my example I am looking for a partial match so it matters?

Cheers

Jake

:+1:

EDIT: The parenthesis are still wrong.

Yes, correct. @jan could’ve used == instead of the contains() function in this particular case and he unfortunately also mixed up the argument order of the contains() function.

If you’re unsure about the argument order, you can also name the arguments so that their order doesn’t matter:

contains(search: "ul st", value: "Full string"); // returns true

Hi Jochen,

The path to enlightenment is a stoney path :slight_smile:
I finally got it working.

Here is the mistake

contains(to_string($message.sysmon_cmd_parent_file,“EXCEL.EXE”))

Corrected
contains(to_string($message.sysmon_cmd_parent_file),“EXCEL.EXE”)

Cheers

Jake

1 Like

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.