Help on Regex extraction and Mapping - Palo Alto Firewall

[sanhyongt1]

Hi guys,

I am trying to extract source Username and Address information from the [message] field.

Palo Alto CEF event:

CEF:0|Palo Alto Networks|PAN-OS|6.0.7|general|SYSTEM|$number-of-severity|rt=May 13 2016 03:41:51 GMT deviceExternalId=001701006145 cs3Label=Virtual System cs3= fname= flexString2Label=Module flexString2=general msg="failed authentication for user 'testuser'.   vsys 'shared', From: 192.168.10.10." externalId=160979 cat=auth-fail

Palo Alto Message value:

msg="failed authentication for user 'testuser'.   vsys 'shared', From: 192.168.10.10."

Regex Mapping done:

regex.event.message,set.expr(message).event.sourceUserName,set.expr(message).event.sourceAddress

""failed authentication for user '\S+'.*From: \d+\.\d+\.\d+\.\d+.*"","__regexToken(message,"""failed authentication for user '(\S+)'.*From.*""")","__regexToken(message,"""failed authentication for user '\S+'.*From: (\d+\.\d+\.\d+\.\d+)\.""")"

Issue:

For testing, I used CEF File connector and send its output to CEF file and CSV file.

However, I don't see any related errors in agent.log and the fields (sourceHostUserName and sourceAddress) are not being mapped.

Can anyone advise how I can go about debug this issue? Or is there anything wrong with my regex expression?

Thanks.

EDIT: Hey guys, I used Tom's variables method on ESM instead.

[Michel Beaudry]

Hi Sanhyongt,

You may have a look at this presentation made in Protect'14, that might give you a hint https://www.protect724.hpe.com/message/54085#comment-54085

Regards,

Michel

[sanhyongt1]

Thanks Michel for the resource, but I have followed through the pointers which were indicated in the Flex Dev guide like the double quotes, and other necessary parameters.

I took reference from   as well but still no go.

[Lewuu · Accepted solution]

Would something like this assist you..

[sanhyongt1]

Thanks Tom, I have tried to import the package, but when I tried to "edit" the rule, it produced a "Java Negative Array Exception".

[Lewuu]

probably an dependency on the base "Activate Package" --  I'll see if I can repackage and repost

[sanhyongt1]

Thanks a lot, Tom.

I loaded mine with Activate Base package and the variables method used is very useful.