Extract particular string from stream

Question

I have a file in which snort signatures are stored, I need to extract Bold ones "sid" and CVE number from that signature, here is a sample signature

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Microsoft WMI Administration Tools WEBSingleView.ocx ActiveX Buffer Overflow Attempt"; flow:established,to_client; file_data; content:"2745E5F5-D234-11D0-847A-00C04FD7BB08"; nocase; distance:0; pcre:"/]classid\s=\s*[\x22\x27]?\sclsid\s\x3a\s*\x7B?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08.+(AddContextRef|ReleaseContext)/smi"; reference:url,xcon.xfocus.net/XCon2010_ChenXie_EN.pdf; reference:url,wooyun.org/bug.php?action=view&id=1006; reference:bid,45546; reference:cve,CVE-2010-3973; classtype:attempted-user; sid:2012158; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag ActiveX, signature_severity Major, created_at 2011_01_06, updated_at 2016_07_01;)

Output: 2012158 [space] CVE-2010-3973

Answer 1

$ grep -E -o -e 'sid:[^;]+' -e 'reference:cve,[^;]+' file | awk -F '[:,]' '{ sid=$2; getline; print sid, $3 }'
2012158 CVE-2010-3973

This uses grep to extract the two bits of info from the data that we are interested in. It does this by using -o (to return only the bit of the line that matches the given expressions) and matching the sid field and the correct reference field. The output of the grep command will be

sid:2012158
reference:cve,CVE-2010-3973

The awk program will then read the first line from grep, extract the number into the variable sid, read the next line and print the stored sid and the third field (a field here is anything delimited by either a comma or a colon).

Answer 2

A small modification to @Kusalananda's answer, piping the output of grep expression to cut seems to work perfectly on my zsh shell.

grep -o -E -e 'sid:[^;]+' -e 'reference:cve,[^;]+' file | cut -d':' -f2 | cut -d',' -f2

Answer 3

j=`awk '{print NF}' filename`
[root@praveen_linux_example ~]# for ((i=1;i<=$j;i++)); do awk -v   i="$i" '$i ~ /CVE-2010-3973/||$i ~ /^sid/{print $i}' filename;done| awk -F [,:] '{print $NF}'| sed "s/;//g"| sed -n -e '1h' -e '2{p;g;p}'| sed "N;s/\n/ /g"

output

2012158 CVE-2010-3973