Splunk Search

How can I use Regex to extract Windows SMB Logs?

kleber_silva
Engager

Hi Splunkers

I need to extract this log below each SMB Path to make a count:

LOG Example:

Here are the SMB shares available on the remote host when logged in as "user account"

  • ADMIN$
  • IPC$
  • Teste
  • Users

I need results came with below :

Action = Here are the SMB shares available on the remote host when logged in a
User = "user account"
Path = ADMIN$
Path = IPC$

Path = Teste
Path = Users

I tried using regex but I can only bring all path together.

Thanks for Help

0 Karma
1 Solution

493669
Super Champion

try this rex:
It might need some sort of modification...but at least it will give you idea...

...|rex  field=_raw "(?s).*\"\s+(?<Action>.*)as\s*(?<User>[^:]+)"|rex max_match=0 field=raw "\s*(?<Path>\w+)\$*[\r\n]\s+"

View solution in original post

0 Karma

493669
Super Champion

try this rex:
It might need some sort of modification...but at least it will give you idea...

...|rex  field=_raw "(?s).*\"\s+(?<Action>.*)as\s*(?<User>[^:]+)"|rex max_match=0 field=raw "\s*(?<Path>\w+)\$*[\r\n]\s+"
0 Karma

micahkemp
Champion

Can you include the raw event in your question? If the above represents the raw event, please use the code button (101010) to format it to make it more easy to work with.

0 Karma

kleber_silva
Engager

Following below @micahkemp thanks for help

"10395","","","None","cmp-00002","tcp","445","Microsoft Windows SMB Shares Enumeration","It is possible to enumerate remote network shares.","By connecting to the remote host, windows was able to enumerate the
network share names.","n/a","","
Here are the SMB shares available on the remote host when logged in as user.account:

  • ADMIN$
  • IPC$
  • Teste
  • Users "
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...