$message
is a reference to the currently processed message and you can access any message field via that reference:
$message.foobar // Message field "foobar"
$message.`foo-baz` // Message field "foo-baz"
$message
is a reference to the currently processed message and you can access any message field via that reference:
$message.foobar // Message field "foobar"
$message.`foo-baz` // Message field "foo-baz"
Hi Jochen,
In my function i had this
when
// detects powershell executing from Excel
has_field(“sysmon_event_id”) AND
has_field(“sysmon_data_process”) AND
has_field(“sysmon_cmd_parent_file”) AND
contains(“1”,to_string($message.sysmon_event_id)) AND
contains(“C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe”, to_string($message.sysmon_data_process)) AND
contains(“EXCEL.EXE”, to_string($message.sysmon_cmd_parent_file))
then
set_field(“Ref”, “T1090”);
end
Now I know that the fields are present because if i do something like
when
has_field(“CustomerID”) AND contains(to_string($message.Channel), “Microsoft-Windows-Sysmon”)
then
let debug_message = concat("Field present ", to_string($message.sysmon_cmd_parent_file));
debug(debug_message);
let debug_message2 = concat("Field present ", to_string($message.sysmon_data_process));
debug(debug_message2);
let debug_message3 = concat("Field present ", to_string($message.sysmon_event_id));
debug(debug_message3);
end
I get the following
So why doesn’t the above trigger? The pipeline stage is set to at least one rule must be matched and there are three rules in total. One of them is the very specific one that you help me create the other day.
Cheers
Jake
Because neither message fulfills the condition in the when
clause of your rule.
Hi Jochen,
Forgive my lack of understanding. If I look at below, i think it should match
I am assuming that EXCEL.exe would match sysmon_cmd_parent_file field unless contains is an explicit match.
Cheers
Jake
Hi Jochen,
I have confirmed that “contains” requires an explicit match. Is there a way to get it to match on part of a string?
Cheers
Jake
The contains()
function does not require an exact match of the complete string.
contains(value: string, search: string, [ignore_case: boolean])
Checks if
value
containssearch
, optionally ignoring the case of the search pattern.
Hi Jochen,
It worked when I change it to the full path, but doesn’t work when i set to excel.exe or EXCEL.EXE.
I wonder if this is the reason why
contains(“C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE”, to_string($message.sysmon_cmd_parent_file))
Notice the space between Microsoft and Office could this cause the match to be terminated and so it never matches?
Cheers
Jake
The strings in the pipeline rule language are basically Java strings ().
This means that back slashes have to be escaped ( "\"
→ "\\"
).
For example, the following function call returns true
:
contains("Foo Bar\\Baz", "Bar\\Baz");
EDIT: Maybe you should check the argument order for the contains()
function in your pipeline rule.
No, the contains()
function doesn’t handle whitespace characters any different than other characters.
Hi Jochen,
so why does it not match then?
If we have the string “C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE” it should match on either excel.exe or EXCEL.EXE?
How can the argument order be wrong if matches on the full path?
Unless, I am being very silly here
Does it have to match the order of appearance in the log file?
Did you do this?
Just think about in which case the contains()
function would return true
, even if the argument order is wrong.
Hi Jochen,
How should the order be:
has_field(“field-x”) AND
has_field(“field-y”) AND
has_field(“field-z”) AND
contains(“match for x”,to_string($message.field-x)) AND
contains(“match for y”, to_string($message.field-y)) AND
contains(“match for z", to_string($message.field-z))
or is it meant to be
has_field(“field-x”) AND
has_field(“field-y”) AND
has_field(“field-z”) AND
contains(“match for x”,to_string($message.field-z)) AND
contains(“match for y”, to_string($message.field-y)) AND
contains(“match for z", to_string($message.field-x))
Cheers
Jake
The order of the function calls doesn’t matter (at least not in your case). The order of arguments in the contains()
function does matter, though.
Hi Jochen,
How do I determine the order that the contains statements should be in? I got my last example wrong.
With below:
has_field(“field-x”) AND
has_field(“field-y”) AND
has_field(“field-z”) AND
contains(“match for x”,to_string($message.field-x)) AND
contains(“match for y”, to_string($message.field-y)) AND
contains(“match for z", to_string($message.field-z))
I would expect that fields x,y,and z need to be present or there is no match. The three fields with the contain statement must also match i.e field-x = “match for x” and field-y =“match for y” and field-z= “match for z”.
Anyone of the six conditions ( 3 x has field or a non field match) results in a negative result.
Do the has_field and condition statement need to be in the same order as the fields in the log?
How does the contains order work? Could you please point me to some other documentation?
Cheers
Jake
You’re chasing the wrong thing.
Take a step back, then read the documentation of the contains()
function at http://docs.graylog.org/en/2.4/pages/pipelines/functions.html#contains, with special attention to the function signature (its name and the parameters the function takes).
Hi Jochen,
The documentation says the following
contains(value: string, search: string, [ignore_case: boolean])
Checks if value contains search, optionally ignoring the case of the search pattern.
So this would mean a contains statement should be
contains(to_string($message.sysmon_cmd_parent_file,“EXCEL.EXE”))
This would search for the “EXCEL.EXE” within the string of the field message.sysmon_cmd_parent_file ie “C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE” with the option to ignore case
This makes sense, however it is in oppostion to my earlier conversation with Jan here at Checking condition in a pipeline
I think I have figured it out.
In the example above the strings are searching for identical matches as the fields can only contain “11” for sysmon_event_id so the order does not matter, where as in my example I am looking for a partial match so it matters?
Cheers
Jake
EDIT: The parenthesis are still wrong.
Yes, correct. @jan could’ve used ==
instead of the contains()
function in this particular case and he unfortunately also mixed up the argument order of the contains()
function.
If you’re unsure about the argument order, you can also name the arguments so that their order doesn’t matter:
contains(search: "ul st", value: "Full string"); // returns true
Hi Jochen,
The path to enlightenment is a stoney path
I finally got it working.
Here is the mistake
contains(to_string($message.sysmon_cmd_parent_file,“EXCEL.EXE”))
Corrected
contains(to_string($message.sysmon_cmd_parent_file),“EXCEL.EXE”)
Cheers
Jake
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.