I have created a TA to analyse the FireEye LEEF logs format.
This format uses `^` (HEX %5E) as field separator.
example.log
Jun 17 09:07:58 fecms fenotify-1189.alert: LEEF:1.0|FireEye|CMS|7.5.2.350291|malware-callback|dvchost=TESTFEEX^sev=7^vlan=0^dstPort=80^cncPort=80^proto=tcp^srcPort=4227^
In order to index every values I tried to modify the sementers.conf
[fireeye_full]
MAJOR = [ ] <> ( ) { } | ! ; , ' " * \n \r \s \t & ? + ^ %21 %26 %2526 %3B %7C %20 %2B %3D -- %2520 %5D %5B %3A %0A %2C %28 %29
MINOR = / : = @ . - $ # % \\ _
[fireeye_indexing]
MAJOR = [ ] <> ( ) { } | ! ; , ' " * \n \r \s \t & ? + ^ %21 %26 %2526 %3B %7C %20 %2B %3D -- %2520 %5D %5B %3A %0A %2C %28 %29
MINOR = / : = @ . - $ # % \\ _
INTERMEDIATE_MAJORS = false
[fireeye_standard]
MAJOR = [ ] <> ( ) { } | ! ; , ' " * \n \r \s \t / : = @ . ? - & $ # + % _ \\ ^ %21 %26 %2526 %3B %7C %20 %2B %3D -- %2520
MINOR =
[fireeye_inner]
MAJOR = [ ] <> ( ) { } | ! ; , ' " * \n \r \s \t / : = @ . ? - & $ # + % _ \\ ^ %21 %26 %2526 %3B %7C %20 %2B %3D -- %2520
MINOR =
[fireeye_outer]
MAJOR = [ ] <> ( ) { } | ! ; , ' " * \n \r \s \t & ? + %5E %21 %26 %2526 %3B %7C %20 %2B %3D -- %2520
MINOR =
[fireeye_none]
MAJOR =
MINOR =
MAJOR_COUNT = 0
LOOKAHEAD = 0
MINOR_COUNT = 0
The configuration in the props.conf is
[fireeye]
pulldown_type = true
category = Network & Security
description = Data from FireEye
SHOULD_LINEMERGE = false
LINE_BREAKER = ((?:\r\n|\n)+)
ANNOTATE_PUNCT = false
SEGMENTATION = fireeye_indexing
SEGMENTATION-all = fireeye_full
SEGMENTATION-inner = fireeye_inner
SEGMENTATION-outer = fireeye_outer
SEGMENTATION-raw = fireeye_none
SEGMENTATION-standard = fireeye_standard
KV_MODE = auto
But nothing to do, the indexation time doesn't separate the difference key=value pairs despite the KV_MODE = auto. The indexed value for the log example above is:
key: dvchost
value: TESTFEEX^sev=7^vlan=0^dstPort=80^cncPort=80^proto=tcp^srcPort=4227^
Does someone know how to make splunk recognize the "^" character as major word segmenter and make the KV_MODE=auto work for this log format?
Thanks in advance
↧