Currently the slack message output captures IPs, etc but not hostnames… So I want to regex that out since I don’t want to use an IP, but a hostname to send the insightagent quarantine to.
Can you post what the payload looks like? This will be kind of tricky maybe.
@hayden_redd The trouble with hostnames is that they’re not really regexable since they don’t have a common format across operating systems. Instead, we rely on matching an argument in this case.
If the Slack command is check-agent-status
then whatever characters come after that on a word boundary (space) we can use a regex to capture those as the hostname. E.g. check-agent-status <hostname>
. Though you also don’t need to use Pattern Match for this anymore, if you’re matching on word boundaries as the Slack trigger now has a new output variable called {{[message].[words]}}
which contains all the words from a triggered Slack message which you can use array indexing to find the index that hostname is stored in. E.g. {{[message].[words].[1]}}
to grab the 2nd word in the list.
To do that in Pattern Match, you can use something like check-agent-status {{hostname:/.*/}}
.
To see lots of examples of Pattern Match expressions, you can search for expressionText
in our Github repository of workflows at https://github.com/rapid7/insightconnect-workflows/. Using grep
, another text searching tool or directly in the Github UI, you can find examples. expressionText
is also used for the filter language, so to differentiate look for the pattern_match
type. E.g.
"type": "pattern_match",
"continueOnFailure": false,
"isDisabled": false,
"parameters": {
"captureAll": false,
"**expressionText**": " {{hash:/[0-9a-z]+/}}",
{{[“Slack Quarantine Trigger”].[message].[text]}} is this
<@U01LJPB3Z36> r7-quarantine-endpoint HOSTNAME7B77
Oh, if it ALWAYS comes in like that. Use string split.
So split on " " (space) as your delimiter. You know the hostname will always be in the 3rd position so you can do…
{{["String Split Step"].[list].[2]}}
(It’s 0 indexed, so 2)
I’m terrible at regex, so if I can get away with it, I’ll use split.
Oh yea, I thought of something else that may help.
In the output of the Chatops step, is there a “words” output? If so, that’s already split the input for you…you’ll just need the 3rd element of that list.
by the way you can use this workflow as a reference:
And instead of the string split you can use the “words” attribute of the Slack trigger.
This already splits the Slack message.
{{[“Slack Trigger on Keyword”].[message].[words]}}
+1 pattern match.
Note gotcha regarding pattern match: Protip: InsightConnect's Pattern Match (re2) won't match non-breaking space using `\s`
I haven’t tested it but something like this:
{{chatops_command:/(?i)r7-quarantine-endpoint/}}[\s\x{A0}]+{{hostname:/[^\s\x{A0}]*/}}