# Vulnerability Scan Detection

**URL:** https://community.graylog.org/t/vulnerability-scan-detection/24483
**Category:** Graylog Central (peer support)
**Tags:** pipeline-rules
**Created:** [June 25, 2022, 7:58pm UTC](https://community.graylog.org/t/vulnerability-scan-detection/24483 "2022-06-25T19:58:16Z")
**Posts on this page:** 1
**Showing post:** 7

<div class="post-metadata">

### Author: ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)
#### Post date: [June 29, 2022, 1:31pm UTC](https://community.graylog.org/t/vulnerability-scan-detection/24483/7 "2022-06-29T13:31:22Z")

</div>

I’m not sure they pay you enough for posts like this @gsmith!

I thought about using the `key_value()` function with the data but only specific fields are desired.

(On a side note it helps a LOT if you post the text of the message rather than a picture, it gives others something to play with for the answer…)

With regex it would be more efficient to have a single search and use the grouping to pull out the things you want… something like this:

```auto
rule "Extract multiple fields"
when
  has_field("message")
then

  let BatSignals = regex("srcport=(\\S+).*proto=(\\S+).*srcintf=(\\S+)", to_string($message.message));

  set_field("srcport", BatSignals["1"]);
  set_field("protocol", BatSignals["2"]);
  set_field("sourceInterface", BatSignals["3"]);  

end

```

---

_[View the full topic](https://community.graylog.org/t/vulnerability-scan-detection/24483)._