I have a file in which snort signatures are stored, I need to extract Bold ones "sid" and CVE number from that signature, here is a sample signature

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Microsoft WMI Administration Tools WEBSingleView.ocx ActiveX Buffer Overflow Attempt"; flow:established,to_client; file_data; content:"2745E5F5-D234-11D0-847A-00C04FD7BB08"; nocase; distance:0; pcre:"/]classid\s=\s*[\x22\x27]?\sclsid\s\x3a\s*\x7B?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08.+(AddContextRef|ReleaseContext)/smi"; reference:url,xcon.xfocus.net/XCon2010_ChenXie_EN.pdf; reference:url,wooyun.org/bug.php?action=view&id=1006; reference:bid,45546; reference:cve,CVE-2010-3973; classtype:attempted-user; sid:2012158; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, deployment Perimeter, tag ActiveX, signature_severity Major, created_at 2011_01_06, updated_at 2016_07_01;)

Output: 2012158 [space] CVE-2010-3973

  • What have you done so far? Have you tried anything on your own? What is the result, if any?
    – Panki
    Jan 4, 2019 at 10:29
  • I have started building the awk: awk '{for (I=1;I<=NF;I++) if ($I == "refernce") {print $(I+1)};}' snort.rules , still I am working on this...
    – chandu
    Jan 4, 2019 at 10:35

3 Answers 3

$ grep -E -o -e 'sid:[^;]+' -e 'reference:cve,[^;]+' file | awk -F '[:,]' '{ sid=$2; getline; print sid, $3 }'
2012158 CVE-2010-3973

This uses grep to extract the two bits of info from the data that we are interested in. It does this by using -o (to return only the bit of the line that matches the given expressions) and matching the sid field and the correct reference field. The output of the grep command will be


The awk program will then read the first line from grep, extract the number into the variable sid, read the next line and print the stored sid and the third field (a field here is anything delimited by either a comma or a colon).


A small modification to @Kusalananda's answer, piping the output of grep expression to cut seems to work perfectly on my zsh shell.

grep -o -E -e 'sid:[^;]+' -e 'reference:cve,[^;]+' file | cut -d':' -f2 | cut -d',' -f2
j=`awk '{print NF}' filename`
[root@praveen_linux_example ~]# for ((i=1;i<=$j;i++)); do awk -v   i="$i" '$i ~ /CVE-2010-3973/||$i ~ /^sid/{print $i}' filename;done| awk -F [,:] '{print $NF}'| sed "s/;//g"| sed -n -e '1h' -e '2{p;g;p}'| sed "N;s/\n/ /g"


2012158 CVE-2010-3973

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .