Skip to content

Instantly share code, notes, and snippets.

@lhaagsma

lhaagsma/fungly named regex for snort fast alert

Created March 7, 2016 09:02
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save lhaagsma/348bbdc9e54ab47cb48a to your computer and use it in GitHub Desktop.
Save lhaagsma/348bbdc9e54ab47cb48a to your computer and use it in GitHub Desktop.
Download ZIP
Raw
fungly named regex for snort fast alert
"(?P<timestamp>../../..-..:..:..\.[0-9]+) .... \[(?P<engine>[0-9]):(?P<sid>[0-9]+):(?P<revision>[0-9]+)\] (?P<msg>.*) \[\*\*\] \[Classification: (?P<classification>[^\]]+)] \[Priority: (?P<priority>[0-9])\] {(?P<proto>[^}]+)} (?P<source_ip>([0-9]{1,3}\.){3}[0-9]{1,3}):(?P<source_port>[0-9]+) -> (?P<destination_ip>([0-9]{1,3}\.){3}[0-9]{1,3}):(?P<destination_port>[0-9]+)"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment