Hi all,
A simple question I am struggling with:
I use regex101.com to test some regex strings that I am creating. I get matches and all is good. Now on regex101.com it provides an output that shows all the matches as groups.
Example:
If there is a match the parts matched in the string are broken up into what is called “Groups”. Now in the graylog rules one has the following rule (snipit)
rule "Extract Snort alert fields"
when
has_field("message")
then
let m = regex("\\[Classification: (.+?)\\] \\[Priority: (\\d+)\\] \\{(.+?)\\} (\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})(:(\\d{1,5}))? -> (\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})(:(\\d{1,5}))?", to_string($message.message));
set_field("classification", m["0"]); // set classification of the log entry
set_field("Priority:", m["1"]); // set the priority of the log entry
When you referring to the results of the regex m[“1”], m[“7”] to set them to the fields in Graylog they don’t seem to match the group numbers of RegEx101.
Question:
Is there a way to debug what the “groups” as Graylog sees them so that one can correctly set them to fields.
Reason why, there is one value in my case src_ip that no matter what index I use in m["<Value"] I cannot find. The RegEx is finding dst_ip (which is after the value I want src_ip) but I cannot find src_ip value.
Ideally what I would like to see is what is in the array m (in my case code below)
Rule:
rule "Extract Snort alert fields"
when
has_field("message")
then
let m = regex("\\[Classification: (.+?)\\] \\[Priority: (\\d+)\\] \\{(.+?)\\} (\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})(:(\\d{1,5}))? -> (\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})(:(\\d{1,5}))?", to_string($message.message));
set_field("snort_alert", true); // set snort alert
set_field("application_name", "snort-alerts"); // set application name
set_field("classification", m["0"]); // set classification of the log entry
set_field("Priority:", m["1"]); // set the priority of the log entry
set_field("Protocol", m["2"]); // which protocol was this log entry received on
set_field("src_addr:", m["3"]); // source address of the log entry suspected address
set_field("lng_src_port", m["4"]); // residue from regex on the source port
let dp = m["4"]; //setting variable for later regex
set_field("Check dp",dp); // setting field as a debug
set_field("src_port", m["5"]); // set the source port the traffic is coming from
set_field("dst_addr", m["6"]); // what is the destination address that the traffic is going to
set_field("lng_dst_port", m["7"]); // residue from original regex for destination port
set_field("dst_addr", m["11"]); // destination address for the log entry
let dp_port = regex_replace("[:]", to_string(m["7"]), ""); // try remove the leading : in the destination port
set_field("dst_port",dp_port); // set the destination port from the dp_port variable
set_field("src_addrs:", m["3"]); // source address of the log entry suspected address
end
I am sure I am doing something wrong however if not at code issue how to see what is stored in M
]