I know its Xmas (Merry Xmas everyone) but this post is a testament to how frustrated I am. I am sure this is a dumb question but I have spent two days on this.
I have a regex that I use to get some values out a Snort log. It works 99% but for one field. There is a destination port: dst_port. If I use regex101.com this value is extracted and is shown as Group 9 (if you count as an array starting at 0). I am doing a normal:
9 = the grouping of the result. All other results work per their grouping numbers.
set_field("src_port", m["5"]); works
I then thought maybe for some reason this datatype is different and tried:
set_field("dst_port", to_long(m["9"])); - in case its a datatype formatting issue for whatever reason and that doesn’t help.
It then lead me to a “quick fix” I also store the port number with the " : " as I use that for something else so example:
:8080 or :8180
I added a second stage to the pipeline (the rule explained above is 0 Stage) that had the following code using a replace:
rule "remove :" when has_field("message") then let dst_port = regex_replace(":", to_string($message.message), ""); end
Now I don’t know if I am understanding the documentation incorrectly for both how you run rules in stages as well as the syntax for the regex_replace function. But it does not remove the " : " from the :<port_number> – what I am trying to do is transform :8080 to just 8080 and there I have a usable port number.
The rule is pretty simple - set / let the dst_port be the outcome of the regex above. The regex above is simple find " : " and replace it with " " (nothing) to remove the " : " at the beginning of the string.
- The normal
set_field("dst_port", m["9"]);should be working off the bat… so I was trying the second rule (and learning at the same time)
- The second rule with regex_replace doesn’t seem to do anything at all. I know I am using $message.message which is the entire message not just that section of the message. This was desperation as well as I wasn’t sure if I did $message.long_dst_port (this stores the :8080) if it would reference or look at that field that was set in rule 1.
Would really appreciate the help or pointers. This thing is driving me crazy and I am sure its something so stupid that I am missing.