-
Notifications
You must be signed in to change notification settings - Fork 45
/
2080_filter_section_h_parse_messages_to_auditLogTrailerMessages.conf
51 lines (46 loc) · 1.89 KB
/
2080_filter_section_h_parse_messages_to_auditLogTrailerMessages.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
filter {
if [type] == "mod_security" {
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Explode all "Messages" from sectionH to first
# class objects w/ properties and store in an array
# called "auditLogTrailerMessages"
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
if [rawSectionH] =~ /.+/ {
# build the auditlog trailer messages
ruby {
code => "
def extractVal(pattern, fromString, storeResultIn, underKeyName, multiValues=false)
if multiValues
result = fromString.scan(pattern)
if !result.empty?
storeResultIn[underKeyName] = result.flatten
end
else
result = pattern.match(fromString)
if !result.nil?
storeResultIn[underKeyName] = result[1]
end
end
end
auditLogTrailerMessages = Array.new()
trailer_array = event.get('rawSectionH').split(/\n/)
trailer_array.each do |entry|
if entry.match(/^Message: /)
msg = Hash.new()
extractVal(/Message: (.+)\s($|(\s*\[file))/, entry, msg, 'info')
extractVal(/\[file \"(.*?)\"\]/, entry, msg, 'file')
extractVal(/\[line \"(.*?)\"\]/, entry, msg, 'line')
extractVal(/\[id \"(.*?)\"\]/, entry, msg, 'id')
extractVal(/\[msg \"(.*?)\"\]/, entry, msg, 'msg')
extractVal(/\[severity \"(.*?)\"\]/, entry, msg, 'severity')
extractVal(/\[data \"(.*?)\"\]/, entry, msg, 'data')
extractVal(/\[tag \"(.*?)\"\]/, entry, msg, 'tag')
auditLogTrailerMessages.push(msg)
end
end
event.set('auditLogTrailerMessages', auditLogTrailerMessages)
"
}
}
}
}