Extrahop detections not parsing correctly with default LEEF parser, workaround available?

[kphamakao0]

Some Extrahop detection events are not being parsed correctly because the default LEEF parser specified in transforms.conf that comes with the Extrahop add-on for splunk is looking for very specific fields in the events. Some extrahop detection events do not contain all of the key-value pairs the LEEF parser is expecting, therefore not all events are parsing correctly.

Default LEEF Parser that comes with add-on

REGEX = \|appliance_id=(?P<appliance_id>[a-f0-9]+)¦categories=(?P<categories>.*?)¦det_id=(?P<id>\d+)¦det_url=(?P<detection_url>.*?)¦update_time=(?P<update_time>\w{3} \d{1,2} \d{4} \d{2}:\d{2}:\d{2} \+0000)¦end_time=(?P<end_time>\w{3} \d{1,2} \d{4} \d{2}:\d{2}:\d{2} \+0000)?¦risk_score=(?P<risk_score>\d+)¦start_time=(?P<start_time>\w{3} \d{1,2} \d{4} \d{2}:\d{2}:\d{2} \+0000)¦title=(?P<title>.*?)¦offender_ip=(?P<offender_ip>.*?)¦victim_ip=(?P<victim_ip>.*?)¦offender_id=(?P<offender_id>.*?)¦victim_id=(?P<victim_id>.*?)¦desc=(?P<description>.*?)$

Example event where the default LEEF parser will not work due to missing key-value pairs

Mar 31 12:13:32 10.1.9.11 LEEF:2.0|ExtraHop|Reveal(x)|7.8|extrahop-detection|xa6|appliance_id=<applianceID>¦categories=sec,sec.caution¦det_id=55834¦det_url=https://<IP address>/extrahop/#/detections/detail/55834¦update_time=Mar 31 2020 12:13:30 +0000¦risk_score=60¦start_time=Mar 31 2020 12:09:59 +0000¦title=Daily Summary: Inbound Suspicious Connections¦victim_ip=<victim_IP>¦victim_id=<victim_id>¦desc=Over the past day, servers received connections from devices with suspicious IP addresses. These IP addresses are considered suspicious based on threat intelligence found in your Reveal(x) system. Investigate to determine if the IP addresses are from malicious endpoints.

[anoryxeh]

Thanks for the question, and sorry for the trouble. I have a fix for this issue in the development branch for the Add-On and I hope to be able to release a new version to Splunkbase in the near future. In the meantime, try this: change the LEEF transform in $SPLUNK_HOME/etc/apps/TA-extrahop_addon/default/transforms.conf to the following:

[LEEF_KVP]
REGEX = ([a-z_]+)=(.*?)(?:\xa6|$)
FORMAT = $1::$2
MV_ADD = true