Regex Not Functioning Properly in XQL

AmirSabei — Wed, 20 Mar 2024 17:25:00 GMT

Hello everyone, I'm attempting to extract fields from DHCP logs but encounter an error stating, "Your query failed to run as it's invalid." my regex code works correctly on regex101 and CyberChef. Does anyone have any insights on how to troubleshoot the issue?

dataset in(infoblox_infoblox_raw )
|filter _raw_log ~=".*dhcpd.*"
|alter event_raw = _raw_log
|alter pid = arrayindex(regextract(_raw_log , "\[(\d+)\]:") ,0) ,
Infobox_host = arrayindex(regextract(_raw_log , "(?:\s+([^\s]+)\s+)?dhcpd") ,0),
mac_address = arrayindex(regextract(_raw_log , "DHCPDISCOVER\sfrom\s([A-Fa-f\d]{2}(?:[:-][A-Fa-f\d]{2}){5})") ,0) ,

hostname1 = arrayindex(regextract(_raw_log , "DHCPDISCOVER\sfrom\s([A-Fa-f\d]{2}(?:[:-][A-Fa-f\d]{2}){5})\(([^)]+)\)") ,0)

|fields hostname1, mac_address, pid, Infobox_host , _raw_log
|limit 100

Thanks

Re: Regex Not Functioning Properly in XQL

aspatil — Thu, 21 Mar 2024 07:18:40 GMT

Hello @AmirSabei ,

Thanks for reaching out on LiveCommunity!

Based on your query it looks like the issue is with Hostname1 field. The regular expression matches a DHCPDISCOVER message followed by a MAC address and an IP address enclosed in parentheses. Can you confirm exactly what are you looking in hostname1 field?

if you run without |fields hostname1 it works fine.

topic Regex Not Functioning Properly in XQL in Cortex XDR Discussions

Regex Not Functioning Properly in XQL

Re: Regex Not Functioning Properly in XQL