1. Describe your incident: I am trying to create a data adapter whose values I can lookup by using a regex pattern. Let’s say I have values like this in my CSV: url,status https://attacker-ip.com/1234,online http://malicious-address.br/abc,online Is there a way to search through the data adapter…

just to recap you problem: you have a CSV with url,status https://attacker-ip.com/1234,online http://malicious-address.br/abc,online and you have a field in one of you messages with .malicious-address.br. now you want to to a little regex-magic to find that domain in your CSV? I would recommend…

That’s exactly what I want to do. Okay, seems like it’s not possible then, unfortunate!

Hello, If you can give use some more info or examples, perhaps I can lab.

Hi gsmith, thanks for the reply. Please have a look at the Github issue where I’ve explained it with some example more in detail: Feature to use Lookup Tables in search queries opened 05:46PM - 10 Oct 22 UTC (UTC) …

Quote from the git: Why? Let’s assume all client DNS lookups are logged. A user clicks on a phishing link and enters his credentials. Since the phishing site is very new, the domain is not contained in any IOC database and therefore a lookup of the domain in the Pipeline is not successful. 10 d…

Exactly, I don’t see the solution in putting old logs through the pipeline again but much rather implementing a feature similar to your Python solution into Graylog, that is, being able to use lookup tables not only for decorators and pipelines but also search queries. This feature would allow endl…

Search through CSV Data adapter via Regex

Graylog Central (peer support)

system (system) Closed October 25, 2022, 10:09am 8

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Use Lookup Table to search trough past data Graylog Central (peer support)	3	525	October 25, 2022
Reference a known malicious CSV list of I.P Addresses Graylog Central (peer support)	8	1595	December 29, 2017
Invoke a graylog lookup from a custom function Graylog Central (peer support)	6	399	August 21, 2020
Using a CSV lookup table within a pipeline Graylog Central (peer support) pipeline-rules , debuggingpl	19	6688	January 26, 2018
Need help on lookup table JSON Graylog Central (peer support) pipeline-rules	24	4104	October 9, 2018

Search through CSV Data adapter via Regex

Related topics