RegEx for QRadar SIEM

Question

我需要为QRadar SIEM创建一个涉及正则表达式的自定义属性。寻找与组Security ID或Account Name匹配的最佳方法，该组当前填充了IT-TESTGRP帐户。目标是提取在Group下找到的任何帐户。我很难找到匹配，同时避免在Subject: & Member:中找到类似的标准。我只想要与Group:关联的帐户

<13>Jan 09 12:50 SRVDC0 AgentDevice=WindowsLog AgentLogFile=Security PluginVersion=7.2.4.86 Source=Microsoft security- Computer=SRVDC0.corp.teslab.ca OriginatingComputer=SRVDC0 User= Domain= EventID=4756 EventIDCode=4756 EventType=8 EventCategory=13826 RecordNumber=1244048131 TimeGenerated=1483983229 TimeWritten=1483983229 PluginVersion=7.2.4.86#成员被添加到一个启用安全功能的通用组中。主题:安全ID: CORP\bforeman帐户名称: bforeman帐户域: CORP登录ID: 0x220f7a57成员:安全ID: CORP\jsmith帐户名: CN=jsmith\、Dan、OU=Exchange用户、DC=corp、DC=testlab、DC=ca Group:安全ID:安全ID：DC=testlab帐户域：IT-TESTGRP帐户域:额外信息:特权：

Answer 1

一种方法是匹配group: Security ID，如下所示：

    Pattern p = Pattern.compile("Group: Security ID: (\\w+)\\\\([^ ]+) Account Name: ([^ ]+) Account Domain: \\1");
Matcher m = p.matcher("Jan 09 12:33:50 SRVDC0 AgentDevice=WindowsLog AgentLogFile=Security PluginVersion=7.2.4.86 Source=Microsoft-Windows-Security-Auditing Computer=SRVDC0.corp.teslab.ca OriginatingComputer=SRVDC0 User= Domain= EventID=4756 EventIDCode=4756 EventType=8 EventCategory=13826 RecordNumber=1244048131 TimeGenerated=1483983229 TimeWritten=1483983229 Level=0 Keywords=0 Task=0 Opcode=0 Message=A member was added to a security-enabled universal group. Subject: Security ID: CORPbforeman Account Name: bforeman Account Domain: CORP Logon ID: 0x220f7a57 Member: Security ID: CORP\\jsmith Account Name: CN=jsmith, Dan,OU=Exchange Users,DC=corp,DC=testlab,DC=ca Group: Security ID: CORP\\IT-TESTGRP Account Name: IT-TESTGRP Account Domain: CORP Additional Information: Privileges:");

while(m.find()){
 System.out.println("domain: "+m.group(1) +", security id: "+m.group(2)+", account Name: "+m.group(3)); 
}

回传

domain: CORP, security id: IT-TESTGRP, account Name: IT-TESTGRP

为了在安全ID之前去掉组，只需匹配反斜杠前面的单词，然后确保该单词与使用反向引用的Account域字符串匹配。

Answer 2

我想出来了-- Group:\s+Security\s+ID:\s+.*?\\([^ ]+) --这是我的用例https://regex101.com/r/5gw5EO/1