-
Notifications
You must be signed in to change notification settings - Fork 305
Separating fields with Key Pairs/Seperators #177
Is there any capability to separate keypair values when creating a chainsaw rule?
I am trying to create a chainsaw rule for PowerShell EventID 400 Events however the output is quite messy as it is all under the Data Field. I have already specified an array index Event.EventData.Data[2] but it would be nice to be able to do something like Event.EventData.Data[2].HostApplication= on key pairs inside the fields if they are consistent.
There are other logs that would use : instead of = so if there is a way to do this for them as well that would be helpful to know!
What I am aiming to do is split the fields out further so instead of NewEngineState=Available HostApplication=powershell -WindowStyle hidden Invoke-WebRequest -URI URL -outfile EXE etc in a single field. They would be split into their own separate columns. So a NewEngineState Column would have Available in it and a Host Application Column would have powershell -WindowStyle hidden Invoke-WebRequest -URI URL -outfile EXE in it.
Thanks!
All reactions
Okay beta.1 is up and fixes the issue. I have also added the option to trim whitespace.
- name: Embedded
container:
field: embedded
format: kv
delimiter: "\r\n\t"
separator: '='
trim: true # default false
to: HostApplication
Replies: 1 comment 13 replies
Okay, so to clarify is it that we have something like this:
Event:
EventData:
Data:
- Foo
- Bar
- NewEngineState=Available HostApplication=powershell -WindowStyle hidden Invoke-WebRequest -URI URL -outfile EXE
Then the request is to allow for parsing of the string at index 2, splitting on space and then looking for key/value pairs?
Event:
EventData:
Data:
- Foo
- Bar
- NewEngineState=Available
HostApplication=powershell -WindowStyle hidden Invoke-WebRequest -URI URL -outfile EXE
If so that should be doable we just need clear rules on how to split the string as splitting on space will not be sufficient and cause erroneous results.
All reactions
I was quite strict on the parsing of pairs so lemme take that line above and do a quick check. I think we might also need a trim option so we can strip that leading \t.
All reactions
Ah I see the issue, its cause there are multiple = in that, lemme tweak the code to only split on the first occurrence.
All reactions
-
👍 1
I was quite strict on the parsing of pairs so lemme take that line above and do a quick check. I think we might also need a trim option so we can strip that leading
\t.
Yeah I noted this when I was testing and as long as I specified the \t in the rule for the NewEngineState as "\tNewEngineState" it parsed fine so this isn't a major issue.
All reactions
Okay beta.1 is up and fixes the issue. I have also added the option to trim whitespace.
- name: Embedded
container:
field: embedded
format: kv
delimiter: "\r\n\t"
separator: '='
trim: true # default false
to: HostApplication
All reactions
-
❤️ 1
This works great so I am happy to close this. Thanks again for adding this feature in!