topic Cut syslog messages, strugeling on commas between quotes in Cortex XSOAR Discussions

Cut syslog messages, strugeling on commas between quotes

r_buchwalder — Fri, 02 Jul 2021 08:23:55 GMT

Hello

Demisto get a syslog message from panorama from threat log.

To clarify my problem, here a simplified syslog output, which Demisto gets in:

1,2,3,"jon,doe",5,6,7 (Example: Mail Subject)

My Problem lies on the syslog incoming Mapper, I would like to cut the syslog message into the right field, (here "Subject")

So, I use as first transformer "Replace match (String)" to get rid of the commas between the "

the only one reasonable regex string I found so far is that one:

,(?=[^"]*"[^"]*(?:"[^"]*"[^"]*)*$)

But since Demisto uses for "Replace match (String)" those Regex-Implementation (https://github.com/google/re2/wiki/Syntax) the ?= regex is not working (NOT IMPLEMENTED)

Is any one here with a solution regarding those "commas between double quotes"? Maybe there is a way on Panorama to escape those commas with ie "=2C"?

Any help will be apriciated

thanks

roger

Re: Cut syslog messages, strugeling on commas between quotes

atullo — Tue, 20 Jul 2021 17:42:02 GMT

If I understand correctly, you'd like for an input field like '1,2,3,"jon,doe",5,6,7' to be transformed into just 'jon,doe' and XSOAR's implementation of regex does not include the positive look ahead operator.

Perhaps this could do what you're looking for:

First, use the 'From string' transformer with one double quote for the 'from' value
Second, use the 'To string' transformer with one double quote for the 'to' value

When its done it should look something like this:
From string (from: ")
To string (to: ")

Hope this helps

Re: Cut syslog messages, strugeling on commas between quotes

r_buchwalder — Fri, 27 Aug 2021 09:43:00 GMT

Hello Atullo

The solution sounds fine, but Wildfire's syslog has more than one field with "-s in it.

And I would like to use it in a mapper, so there are 78 mappings for each Syslog-Entry. And this is only for Wildfire-Mapping.

is there no easier way?
I think that this is a "normal" syslog behavior, that commas are present in the comments inside of ".

thanks

roger

Re: Cut syslog messages, strugeling on commas between quotes

atullo — Fri, 27 Aug 2021 11:13:11 GMT

Roger,

Thanks for providing that simplified syslog output in your original post. Could you provide an actual syslog message? Please redact anything sensitive of course.

Thanks

Re: Cut syslog messages, strugeling on commas between quotes

r_buchwalder — Mon, 30 Aug 2021 09:02:08 GMT

Hello Atullo

So, here one example:

1,2021/08/26 15:03:56,013201006616,THREAT,wildfire,2305,2021/08/26 15:03:51,1.1.1.1,2.2.2.2,0.0.0.0,0.0.0.0,SMTP-Traffic,,,smtp-base,vsys0,DMZ,EXT,ae2.2,ae1.1,PANORAMA,2021/08/26 15:03:51,1015351,1,58020,25,0,0,0x1102000,tcp,allow,"http://<url>/r/?id=tc08d19,8cb4a0,9b03889&p1=%40kjsI",Email Link(52143),phishing,high,client-to-server,6951421833034849569,0xa000000000000000,<countr>,10.0.0.0-10.255.255.255,0,,0,<sha256>,eu.wildfire.paloaltonetworks.com,0,,email-link,,,<sender-Email>,"Buy It, Mike!",<recipient Email>,5131320962,2060,1816,0,0,DMZ-1,<machinename>,,,,,0,,0,,N/A,unknown,WildFire-0,0x0,0,4294967295,,,<code>,0,

I've replaced some stuff with <> and modified IP's, vlans etc.

regards

roger