How would you regex Slack message to get hostname for Insightagent quarantine?

Currently the slack message output captures IPs, etc but not hostnames… So I want to regex that out since I don’t want to use an IP, but a hostname to send the insightagent quarantine to.

Can you post what the payload looks like? This will be kind of tricky maybe.

@hayden_redd The trouble with hostnames is that they’re not really regexable since they don’t have a common format across operating systems. Instead, we rely on matching an argument in this case.

If the Slack command is check-agent-status then whatever characters come after that on a word boundary (space) we can use a regex to capture those as the hostname. E.g. check-agent-status <hostname>. Though you also don’t need to use Pattern Match for this anymore, if you’re matching on word boundaries as the Slack trigger now has a new output variable called {{[message].[words]}} which contains all the words from a triggered Slack message which you can use array indexing to find the index that hostname is stored in. E.g. {{[message].[words].[1]}} to grab the 2nd word in the list.

To do that in Pattern Match, you can use something like check-agent-status {{hostname:/.*/}}.

To see lots of examples of Pattern Match expressions, you can search for expressionText in our Github repository of workflows at https://github.com/rapid7/insightconnect-workflows/. Using grep, another text searching tool or directly in the Github UI, you can find examples. expressionText is also used for the filter language, so to differentiate look for the pattern_match type. E.g.

    "type": "pattern_match",
    "continueOnFailure": false,
    "isDisabled": false,
    "parameters": {
      "captureAll": false,
      "**expressionText**": " {{hash:/[0-9a-z]+/}}",
2 Likes

{{[“Slack Quarantine Trigger”].[message].[text]}} is this

<@U01LJPB3Z36> r7-quarantine-endpoint HOSTNAME7B77

Oh, if it ALWAYS comes in like that. Use string split.

So split on " " (space) as your delimiter. You know the hostname will always be in the 3rd position so you can do…

{{["String Split Step"].[list].[2]}} (It’s 0 indexed, so 2)

I’m terrible at regex, so if I can get away with it, I’ll use split.

Oh yea, I thought of something else that may help.

In the output of the Chatops step, is there a “words” output? If so, that’s already split the input for you…you’ll just need the 3rd element of that list.

by the way you can use this workflow as a reference:

And instead of the string split you can use the “words” attribute of the Slack trigger.
This already splits the Slack message.

{{[“Slack Trigger on Keyword”].[message].[words]}}

+1 pattern match.

Note gotcha regarding pattern match: Protip: InsightConnect's Pattern Match (re2) won't match non-breaking space using `\s`

I haven’t tested it but something like this:

{{chatops_command:/(?i)r7-quarantine-endpoint/}}[\s\x{A0}]+{{hostname:/[^\s\x{A0}]*/}}

1 Like