0

I have a snort.rule file, I need to extract cve numbers followed by reference key from the line and append them back in msg field of the same line inside flower brackets, below is the old log.

alert udp $HOME_NET 1900 -> any any (msg:"ET INFO UPnP Discovery Search Response vulnerable UPnP device 2"; content:"Intel SDK for UPnP devices"; pcre:"/^Server\x3a[^\r\n]*Intel SDK for UPnP devices/mi"; reference: /infosec/blog/2013/01/29; reference:arch/UPnP-arch-DeviceArchitecture-v1.1.pdf; reference:cve,2012-5958; reference:cve,2012-5959;sid:2016303; rev:4;)

Required output is below, bold ones are the new changes,

alert udp $HOME_NET 1900 -> any any (msg:"ET INFO UPnP Discovery Search Response vulnerable UPnP device 2 {cve,2012-5958 cve,2012-5959}"; content:"Intel SDK for UPnP devices"; pcre:"/^Server\x3a[^\r\n]*Intel SDK for UPnP devices/mi"; reference: /infosec/blog/2013/01/29; reference: arch/UPnP-arch-DeviceArchitecture-v1.1.pdf; reference:cve,2012-5958; reference:cve,2012-5959;sid:2016303; rev:4;)

I am able to extract the CVE numbers, but appending back I am not getting

cat /tmp/snort.rule | grep -o -E -e 'sid:[^;]+' -e 'reference:cve,[^;]+'
  • Please edit your input and output so the changes are more obvious without having to scroll – glenn jackman Mar 6 at 14:12
1

Well you can try this out, copy this in a shell file and run this, you can store the output to new file. awk -F\; ' { for ( i = 1 ; i <= NF ; i++ ) { if ( $i ~ "msg" ) a = i if ( $i ~ "reference:cve," ) { b = $i sub ( ".*:" , "" , b ) c = c " " b } } sub ( ".$" , "{" c "\"}" , $a ) } 1' /tmp/snort.rule

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.