Sfdwhf

Are there any other Chaos-worshipping races?

Misplaced tyre lever - alternatives?

What does @RC mean in SSDT SQL Server Unit Testing?

Why do members of Congress in committee hearings ask witnesses the same question multiple times?

Can a space-faring robot still function over a billion years?

Is there any relevance to Thor getting his hair cut other than comedic value?

How to mitigate "bandwagon attacking" from players?

What is a term for a function that when called repeatedly, has the same effect as calling once?

How can I be pwned if I'm not registered on the compromised site?

Test pad's ESD protection

Canadian citizen, on US no-fly list. What can I do in order to be allowed on flights which go through US airspace?

Is the withholding of funding notice allowed?

If a set is open, does that imply that it has no boundary points?

What is better: yes / no radio, or simple checkbox?

I encountered my boss during an on-site interview at another company. Should I bring it up when seeing him next time?

How to make a *empty* field behaves like a *null* field when it comes to standard values?

What are the issues with an additional (limited) concentration slot instead of Bladesong?

Are paired adjectives bad style?

Why do phishing e-mails use faked e-mail addresses instead of the real one?

How can atoms be electrically neutral when there is a difference in the positions of the charges?

Did Amazon pay $0 in taxes last year?

Calculating Hyperbolic Sin faster than using a standard power series

Make me a metasequence

Book about a time-travel war fought by computers

Log file extract data and append back same line

How can I extract user data from a file with awk and create a new user based on it?Linux : Data extraction from text fileextract line from fileHow can I extract pdf names from an lftp log file?append search term to a log file nameRemove line from a file which is named in anotherUse sed and grep to extract data for particular months in a file with timestampsExtract the content from a file between two match patterns (Extract only HTML from a file)How to filter the below log file between time stampsappend line command not working in terminal

0

I have a snort.rule file, I need to extract cve numbers from the line and append them back in msg field of the same line inside flower brackets, below is the old log.

alert udp $HOME_NET 1900 -> any any (msg:"ET INFO UPnP Discovery Search Response vulnerable UPnP device 1"; content:"miniupnpd/1."; fast_pattern:only; pcre:"/^Serverx3a[^rn]*miniupnpd/1.[0-3]/mi"; reference:url/29/security -dont-play; reference: arch/Architecture-v1.1.pdf; reference:cve,2013-0229;sid:2016302; rev:5;)

alert udp $HOME_NET 1900 -> any any (msg:"ET INFO UPnP Discovery Search Response vulnerable UPnP device 2"; content:"Intel SDK for UPnP devices"; pcre:"/^Serverx3a[^rn]*Intel SDK for UPnP devices/mi"; reference: /infosec/blog/2013/01/29; reference:arch/UPnP-arch-DeviceArchitecture-v1.1.pdf; reference:cve,2012-5958; reference:cve,2012-5959;sid:2016303; rev:4;)

Required output,

alert udp $HOME_NET 1900 -> any any (msg:"ET INFO UPnP Discovery Search Response vulnerable UPnP device 1 {cve,2013-0229}"; content:"miniupnpd/1."; fast_pattern:only; pcre:"/^Serverx3a[^rn]*miniupnpd/1.[0-3]/mi"; reference:url/29/security -dont-play; reference: arch/Architecture-v1.1.pdf; reference:cve,2013-0229;sid:2016302; rev:5;)

alert udp $HOME_NET 1900 -> any any (msg:"ET INFO UPnP Discovery Search Response vulnerable UPnP device 2 {cve,2012-5958 cve,2012-5959}"; content:"Intel SDK for UPnP devices"; pcre:"/^Serverx3a[^rn]*Intel SDK for UPnP devices/mi"; reference: /infosec/blog/2013/01/29; reference: arch/UPnP-arch-DeviceArchitecture-v1.1.pdf; reference:cve,2012-5958; reference:cve,2012-5959;sid:2016303; rev:4;)

I am able to extract the CVE numbers, but appending back I am not getting

cat /tmp/snort.rule | grep -o -E -e 'sid:[^;]+' -e 'reference:cve,[^;]+'

scripts grep awk

share

asked 4 mins ago

chandruchandru

1

New contributor

chandru is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

add a comment | 

0

I have a snort.rule file, I need to extract cve numbers from the line and append them back in msg field of the same line inside flower brackets, below is the old log.

alert udp $HOME_NET 1900 -> any any (msg:"ET INFO UPnP Discovery Search Response vulnerable UPnP device 1"; content:"miniupnpd/1."; fast_pattern:only; pcre:"/^Serverx3a[^rn]*miniupnpd/1.[0-3]/mi"; reference:url/29/security -dont-play; reference: arch/Architecture-v1.1.pdf; reference:cve,2013-0229;sid:2016302; rev:5;)

alert udp $HOME_NET 1900 -> any any (msg:"ET INFO UPnP Discovery Search Response vulnerable UPnP device 2"; content:"Intel SDK for UPnP devices"; pcre:"/^Serverx3a[^rn]*Intel SDK for UPnP devices/mi"; reference: /infosec/blog/2013/01/29; reference:arch/UPnP-arch-DeviceArchitecture-v1.1.pdf; reference:cve,2012-5958; reference:cve,2012-5959;sid:2016303; rev:4;)

Required output,

alert udp $HOME_NET 1900 -> any any (msg:"ET INFO UPnP Discovery Search Response vulnerable UPnP device 1 {cve,2013-0229}"; content:"miniupnpd/1."; fast_pattern:only; pcre:"/^Serverx3a[^rn]*miniupnpd/1.[0-3]/mi"; reference:url/29/security -dont-play; reference: arch/Architecture-v1.1.pdf; reference:cve,2013-0229;sid:2016302; rev:5;)

alert udp $HOME_NET 1900 -> any any (msg:"ET INFO UPnP Discovery Search Response vulnerable UPnP device 2 {cve,2012-5958 cve,2012-5959}"; content:"Intel SDK for UPnP devices"; pcre:"/^Serverx3a[^rn]*Intel SDK for UPnP devices/mi"; reference: /infosec/blog/2013/01/29; reference: arch/UPnP-arch-DeviceArchitecture-v1.1.pdf; reference:cve,2012-5958; reference:cve,2012-5959;sid:2016303; rev:4;)

I am able to extract the CVE numbers, but appending back I am not getting

cat /tmp/snort.rule | grep -o -E -e 'sid:[^;]+' -e 'reference:cve,[^;]+'

scripts grep awk

share

asked 4 mins ago

chandruchandru

1

New contributor

chandru is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

add a comment | 

I have a snort.rule file, I need to extract cve numbers from the line and append them back in msg field of the same line inside flower brackets, below is the old log.

alert udp $HOME_NET 1900 -> any any (msg:"ET INFO UPnP Discovery Search Response vulnerable UPnP device 1"; content:"miniupnpd/1."; fast_pattern:only; pcre:"/^Serverx3a[^rn]*miniupnpd/1.[0-3]/mi"; reference:url/29/security -dont-play; reference: arch/Architecture-v1.1.pdf; reference:cve,2013-0229;sid:2016302; rev:5;)

alert udp $HOME_NET 1900 -> any any (msg:"ET INFO UPnP Discovery Search Response vulnerable UPnP device 2"; content:"Intel SDK for UPnP devices"; pcre:"/^Serverx3a[^rn]*Intel SDK for UPnP devices/mi"; reference: /infosec/blog/2013/01/29; reference:arch/UPnP-arch-DeviceArchitecture-v1.1.pdf; reference:cve,2012-5958; reference:cve,2012-5959;sid:2016303; rev:4;)

Required output,

alert udp $HOME_NET 1900 -> any any (msg:"ET INFO UPnP Discovery Search Response vulnerable UPnP device 1 {cve,2013-0229}"; content:"miniupnpd/1."; fast_pattern:only; pcre:"/^Serverx3a[^rn]*miniupnpd/1.[0-3]/mi"; reference:url/29/security -dont-play; reference: arch/Architecture-v1.1.pdf; reference:cve,2013-0229;sid:2016302; rev:5;)

alert udp $HOME_NET 1900 -> any any (msg:"ET INFO UPnP Discovery Search Response vulnerable UPnP device 2 {cve,2012-5958 cve,2012-5959}"; content:"Intel SDK for UPnP devices"; pcre:"/^Serverx3a[^rn]*Intel SDK for UPnP devices/mi"; reference: /infosec/blog/2013/01/29; reference: arch/UPnP-arch-DeviceArchitecture-v1.1.pdf; reference:cve,2012-5958; reference:cve,2012-5959;sid:2016303; rev:4;)

I am able to extract the CVE numbers, but appending back I am not getting

cat /tmp/snort.rule | grep -o -E -e 'sid:[^;]+' -e 'reference:cve,[^;]+'

scripts grep awk

share

asked 4 mins ago

chandruchandru

1

New contributor

chandru is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

cat /tmp/snort.rule | grep -o -E -e 'sid:[^;]+' -e 'reference:cve,[^;]+'

share

asked 4 mins ago

chandruchandru

1

New contributor

chandru is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

share

asked 4 mins ago

chandruchandru

1

New contributor

chandru is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

asked 4 mins ago

chandruchandru

1

New contributor

chandru is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.

asked 4 mins ago

chandruchandru

1