Never mind 🙂
I've been able to create these extractions myself.
EXTRACT-RT_SCREEN_ICMP
(?i)-RT_SCREEN_ICMP: (?P.+?)\s+\w+:\D+(?P\d+.\d+.\d+.\d+)\,\sdestination:\D+(?P\d+.\d+.\d+.\d+)\,\szone\sname:\s(?P\S+)\,\sinterface\sname:\s(?P\S+)
EXTRACT-RT_SCREEN_TCP
(?i)-RT_SCREEN_TCP: (?P.+?)\s+\w+:\D+(?P\d+.\d+.\d+.\d+):(?P\d+)\,\sdestination:\D+(?P\d+.\d+.\d+.\d+):(?P\d+)\,\szone\sname:\s(?P\S+)\,\sinterface\sname:\s(?P\S+)
EXTRACT-RT_SCREEN_IP
(?i)-RT_SCREEN_IP: (?P.+?)\s+\w+:\D+(?P\d+.\d+.\d+.\d+)\,\sdestination:\D+(?P\d+.\d+.\d+.\d+)\,\sprotocol-id:\s(?P\d+)\,\szone\sname:\s(?P\S+)\,\sinterface\sname:\s(?P\S+)
Hope this helps others.
Jerrad,
Any chance you have a field extraction for the IDS reporting on the SRX?
Here's a sample of the security log output:
Mar 14 09:43:50 Mar 14 09:43:50 RT_IDS: %USER-3-RT_SCREEN_TCP: Port scan! source: :80, destination: :27743, zone name: untrust, interface name: ae1.0
I already have some field extractions that I made for SRX
Created Session Logs
RT_FLOW_SESSION_CREATE:\ssession\screated\s(?P<srx_src_ip>\d+\.\d+\.\d+\.\d+)\/(?P<srx_src_port>\d+)\D+(?P<srx_dst_ip>\d+\.\d+\.\d+\.\d+)\/(?P<srx_dst_port>\d+)\s(?P<srx_svc_name>\S+)\s(?P<srx_nat_src_ip>\d+\.\d+\.\d+\.\d+)\/(?P<srx_nat_src_port>\d+)\D+(?P<srx_nat_dst_ip>\d+\.\d+\.\d+\.\d+)\/(?P<srx_nat_dst_port>\d+)\s(?P<srx_src_nat_rule_name>\S+)\s(?P<srx_dst_nat_rule_name>\S+)\s(?P<srx_protocol_id>\d+)\s(?P<srx_policy_name>\S+)\s(?P<srx_src_zone>\S+)\s(?P<srx_dst_zone>\S+)\s(?P<srx_sess_id>\d+)
Closed Session Logs
RT_FLOW_SESSION_CLOSE:\ssession\sclosed\s(?P<srx_closed_reason>[^:]+)\D+(?P<srx_src_ip>\d+\.\d+\.\d+\.\d+)\/(?P<srx_src_port>\d+)\D+(?P<srx_dst_ip>\d+\.\d+\.\d+\.\d+)\/(?P<srx_dst_port>\d+)\s(?P<srx_svc_name>\S+)\s(?P<srx_nat_src_ip>\d+\.\d+\.\d+\.\d+)\/(?P<srx_nat_src_port>\d+)\D+(?P<srx_nat_dst_ip>\d+\.\d+\.\d+\.\d+)\/(?P<srx_nat_dst_port>\d+)\s(?P<srx_src_nat_rule_name>\S+)\s(?P<srx_dst_nat_rule_name>\S+)\s(?P<srx_protocol_id>\d+)\s(?P<srx_policy_name>\S+)\s(?P<srx_src_zone>\S+)\s(?P<srx_dst_zone>\S+)\s(?P<srx_sess_id>\d+)\s(?P<srx_pkts_from_client>\d+)\((?P<srx_bytes_from_client>\d+)\)\s(?P<srx_pkts_from_server>\d+)\((?P<srx_bytes_from_server>\d+)\)\s(?P<srx_sess_elapsed_time>\d+)