IDR query to match on part of a string

InsightIDR Log Search
1

Hi,

How can I perform a match\where on part of string? I’m tying myself in knots with regex and I’m sure there’s something simple that actually works!

For example: I have a field called data.desc that contains string like ‘match to abc found: abc’ or ‘match to abc found: acd’. What I want to do is return all the events where abc is found after the : (i.e. return the first example and not the second). This regex obtains the data from the : onwards :.*$ but I can’t work out how to apply that to compare the result of that to abc.

Thanks in advance.

2

@talford you could build a capture group to do this

it would be something like

where(/match to abc found: (?P[^"]+)/ keyname=abc)

The regex here is [^"]+ saying match until the next double quote, so whatever comes after the abc string.

If you provide an actual log example I’ll be better able to construct the query

David

3

Thanks David,

The log entries are huge so i won;t include the whole thing, but they look like this:

“custom_data”: {
…
“desc”: “Variation of protected domain abc.com found: abc.com.hk”,
…
}

The data is from a brand-protection system that looks for domains being registered, updated etc that are similar to ours but, because some of our domains are simply three characters long, it picks up all variations. For example abd.com, kbc.com, fab.com would all match abc.com and create an event log, so what i’m trying to do is create a search where the discovered domain only contains an match to the three characters abc anywhere in the section after the :

I’ll then use this search to generate alerts to prioritise investigations rather than go through lists of domains that are less likely to be relevant.

4

Thanks, my example should work:

where(/Variation of protected domain abc.com found: (?P[^"]+)/)groupby(domain)

David

5

Well, I couldn’t get your example to work, but while staring at it I had a thought and I think I thought this was more complicated than it actually is:

This simple solution seems to work: where(“custom_data.desc” = /.*found:.abc./)