Regex | Enter the regex and the capture group number. | |
JSON Keypath | A valid JSON expression is in the form: /"<name of top-level field>" For an event in a nested JSON format, a valid JSON expression
is in the form: /"<name of top-level field>"/"<name
of sub-level field>"..../"<name of sub-level field_n>" To extract the 'user' field, type /"user" in the JsonKeypath field. To extract just the 'last_name' value from the 'user' subobject,
type this expression: /"user"/"last_name" | The following example is a simple case of an event for
a flat JSON record: {"action": "login", "user": "Firstname Lastname"}
The following example is a complex case of an event for a JSON
record with nested objects: { "action": "login", "user": { "first_name": "Firstname",
"last_name": "Lastname" } }
|
LEEF Key | Valid LEEF expressions are in the form of either a single
key reference, or a special LEEF header field reference. To extract the 'usrName' property, type usrName in the LEEF Key field. The possible keys that can be extracted in these examples are: - devTimeFormat - devTime - usrName - name - authType - src
To extract a header key property, type the key in the following
format in the LEEF Key field: $eventid$
The LEEF header values can be extracted by using the following
expressions: - $leefversion$ - $vendor$ - $product$ - $version$ - $eventid$
| The following example is a simple case of an event that
is formatted in LEEF V1.0: LEEF:1.0|ABC Company|SystemDefender
|1.13|console_login|devTimeFormat
=yyyy-MM-dd’T’HH:mm:ss.
SSSZ devTime=2017-10-18T11:26:03.060+0200
usrName=flastname name=
Firstname Lastname authType
=interactive
Password src=192.168.0.1
The following example is a simple case of an event that is formatted
in LEEF V2.0 with the caret (^) separator character, and contains
the same keys as the LEEF V1.0 example: LEEF:2.0|ABC Company|SystemDefender|1.13|
console_login|^|devTimeFormat
=yyyy-MMdd’T’HH:mm:ss.SSSZ^
devTime=2017-10-18T11:26:03.060+0200
^usrName=flastname^name=
Firstname Lastname ^authType
=interactive
Password^src=192.168.0.1
|
CEF Key | Valid CEF expressions are in the form of either a single
key reference, or a special CEF header field reference. To extract the 'cs1' property, type cs1 in the CEF Key field. The possible keys that can be extracted in the example are: - start - duser - cs1 - cs1Label - cs2 - cs2Label - src
To extract a header key property, type the key in the following
format in the CEF Key field: $id$
The CEF header values can be extracted by using the following
expressions: - $cefversion$ - $vendor$ - $product$ - $version$ - $id$ - $name$ - $severity$
| The following example shows an event that is in CEF format: CEF:0|ABC Company| SystemDefender|1.13| console_login|
Console Login|1|start=Oct 18 2017 11:26:03 duser=flastname cs1=Firstname
Lastname cs1Label=Person Name cs2=interactivePassword cs2Label=authType
src=192.168.0.1
|
Name Value Pair Key | Valid Name Value Pair expressions are in the form of
a single key reference. | The following example shows an event that is in Name
Value Pair format: Company=ABC Company;Product=SystemDefender; Version=1.13;EventID=console_login;
Username=jsmith;Name=John Smith;authType=interactivePassword;
|
Generic List Keypath | Valid Generic List expressions are in the form of a $<number>notation. For example, $0 represents the first
property in the list, $1 is the second property, and so on. | The following example shows an event that is in Generic
List format: ABC Company;1.13;console_login;jsmith; John Smith;interactivePassword;
|
XML Key | Valid XML expressions are in the form of a single key
reference. Enter the path to the XML field that you want to use to populate
the property's value. An XML key path must begin with a forward slash
(/) to indicate the root of the XML object, and be followed by one
or more XML field names within double quotation marks. | The following example shows an event that is in XML format: <EPOEvent><MachineInfo>
<MachineName>NEPTUNE<
/MachineName><MachineName
>VALUE23</MachineName>
<AgentGUID>9B-B5-A6-A8-37-B3<
/ AgentGUID><IPAddress
someattrib
="someattribvalue">192.0.2.0
</IPAddress><OSName>Windows 7</ OSName>
<UserName>I
am a test user
<UserName></MachineInfo>
</EPOEvent>
|
