0

I have a snort.rule file, I need to extract cve numbers followed by reference key from the line and append them back in msg field of the same line inside flower brackets, below is the old log.

alert udp $HOME_NET 1900 -> any any (msg:"ET INFO UPnP Discovery Search Response vulnerable UPnP device 2"; content:"Intel SDK for UPnP devices"; pcre:"/^Server\x3a[^\r\n]*Intel SDK for UPnP devices/mi"; reference: /infosec/blog/2013/01/29; reference:arch/UPnP-arch-DeviceArchitecture-v1.1.pdf; reference:cve,2012-5958; reference:cve,2012-5959;sid:2016303; rev:4;)

Required output is below, bold ones are the new changes,

alert udp $HOME_NET 1900 -> any any (msg:"ET INFO UPnP Discovery Search Response vulnerable UPnP device 2 {cve,2012-5958 cve,2012-5959}"; content:"Intel SDK for UPnP devices"; pcre:"/^Server\x3a[^\r\n]*Intel SDK for UPnP devices/mi"; reference: /infosec/blog/2013/01/29; reference: arch/UPnP-arch-DeviceArchitecture-v1.1.pdf; reference:cve,2012-5958; reference:cve,2012-5959;sid:2016303; rev:4;)

I am able to extract the CVE numbers, but appending back I am not getting

cat /tmp/snort.rule | grep -o -E -e 'sid:[^;]+' -e 'reference:cve,[^;]+'
1
  • Please edit your input and output so the changes are more obvious without having to scroll
    – glenn jackman
    Mar 6, 2019 at 14:12

1 Answer 1

Reset to default
1

Well you can try this out, copy this in a shell file and run this, you can store the output to new file. awk -F\; ' { for ( i = 1 ; i <= NF ; i++ ) { if ( $i ~ "msg" ) a = i if ( $i ~ "reference:cve," ) { b = $i sub ( ".*:" , "" , b ) c = c " " b } } sub ( ".$" , "{" c "\"}" , $a ) } 1' /tmp/snort.rule

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .