question, are you sure this isn't wrapped in {} making it valid json?If it is, you could use jq to pull it apart and output the things in the order/format that you want them (to match a parser)
David Lang On Thu, 28 May 2015, Mark Feferman wrote:
Date: Thu, 28 May 2015 12:28:45 -0700 (PDT) From: Mark Feferman <[email protected]> Reply-To: [email protected] To: [email protected] Subject: [ossec-list] Re: AWS Cloudtrail decoder One thing to note: I've tried the various components of the regex, in different combinations, and I am successful at pulling in three of the four, including the sourceIPAddress, but when all four are combined, as in my original post, I fail. :( On Thursday, May 28, 2015 at 12:59:13 PM UTC-5, Mark Feferman wrote:I'm working on a decoder to pull information out of the AWS Cloudtrail logs. There are several examples online and I used them as a starting point. I've successfully pulled three components out of each Cloudtrail log, but am not having success when I add a fourth. I've split the regex up to see if each individual component works and they do, but when I combine them all, I'm not having any success (when I test with ossec-logtest. It could be that I'm missing something simple, but I'm also wondering if there's a limitation to the regex string length. I haven't looked at the source and am hoping it is something I'm just missing. Below are both the regex and the sample Cloudtrail log entry I am trying to parse. Any help would be greatly appreciated. sample log entry (it's all one line) #################################################################### "eventVersion":"1.02","eventID":"c0b8a753-65f8-4ea8-a924-263d4555a725","eventTime":"2015-02-19T19:46:40Z","requestParameters":"{u'maxItems': u'100'}","eventType":"AwsApiCall","responseElements":"None","awsRegion":"us-east-1","eventName":"ListHealthChecks","userIdentity":"{u'userName': u'mark.feferman', u'principalId': u'AIDAJCZ7AIQAFLV3CQZJA', u'accessKeyId': u'ASIAJX7ZFLPD2SJOPQXQ', u'invokedBy': u'signin.amazonaws.com', u'sessionContext': {u'attributes': {u'creationDate': u'2015-02-19T19:43:21Z', u'mfaAuthenticated': u'false'}}, u'type': u'IAMUser', u'arn': u'arn:aws:iam::875787860505:user/mark.feferman', u'accountId': u'875787860505'}","eventSource":"route53.amazonaws.com ","requestID":"0634d15d-b870-11e4-827b-6158e160b350","apiVersion":"2013-04-01","userAgent":" signin.amazonaws.com ","sourceIPAddress":"192.168.1.1","recipientAccountId":"875787860505" #################################################################### decoder #################################################################### <decoder name="cloudtrail"> <prematch>^"eventVersion":"\d.\d\d"</prematch> <!-- the below DOES work and retrieves the awsRegion, username, and IP address --> <!-- <regex>"awsRegion":"(\S+)"\.+"eventName":"(\S+)"\.+"userIdentity":"{u'userName': u'(\S+)'</regex> --> <!-- the below line DOES NOT work (when I add the sourceIPAddress --> <regex>"awsRegion":"(\S+)"\.+"eventName":"(\S+)"\.+"userIdentity":"{u'userName': u'(\S+)'\.+"sourceIPAddress":"(\d+.\d+.\d+.\d+)"</regex> <order>data,action,srcuser,srcip</order> </decoder> #################################################################### Sincerely, Mark Mark Feferman, CISM, CISSP, CSSLP Principal @ Vaunted Group [email protected] 713.478.5150 http://www.vauntedgroup.com Expertise in the discipline of Software Security Assurance
