Separating fields with Key Pairs/Seperators

[reece394]

Is there any capability to separate keypair values when creating a chainsaw rule?

I am trying to create a chainsaw rule for PowerShell EventID 400 Events however the output is quite messy as it is all under the Data Field. I have already specified an array index Event.EventData.Data[2] but it would be nice to be able to do something like Event.EventData.Data[2].HostApplication= on key pairs inside the fields if they are consistent.

There are other logs that would use : instead of = so if there is a way to do this for them as well that would be helpful to know!

What I am aiming to do is split the fields out further so instead of NewEngineState=Available HostApplication=powershell -WindowStyle hidden Invoke-WebRequest -URI URL -outfile EXE etc in a single field. They would be split into their own separate columns. So a NewEngineState Column would have Available in it and a Host Application Column would have powershell -WindowStyle hidden Invoke-WebRequest -URI URL -outfile EXE in it.

Thanks!

[alexkornitzer]

Okay, so to clarify is it that we have something like this:

Event:
  EventData:
    Data:
    - Foo
    - Bar
    - NewEngineState=Available HostApplication=powershell -WindowStyle hidden Invoke-WebRequest -URI URL -outfile EXE

Then the request is to allow for parsing of the string at index 2, splitting on space and then looking for key/value pairs?

Event:
  EventData:
    Data:
    - Foo
    - Bar
    - NewEngineState=Available
      HostApplication=powershell -WindowStyle hidden Invoke-WebRequest -URI URL -outfile EXE

If so that should be doable we just need clear rules on how to split the string as splitting on space will not be sufficient and cause erroneous results.

[alexkornitzer]

I was quite strict on the parsing of pairs so lemme take that line above and do a quick check. I think we might also need a trim option so we can strip that leading \t.

[alexkornitzer]

Ah I see the issue, its cause there are multiple = in that, lemme tweak the code to only split on the first occurrence.

[reece394]

I was quite strict on the parsing of pairs so lemme take that line above and do a quick check. I think we might also need a trim option so we can strip that leading \t.

Yeah I noted this when I was testing and as long as I specified the \t in the rule for the NewEngineState as "\tNewEngineState" it parsed fine so this isn't a major issue.

[alexkornitzer]

Okay beta.1 is up and fixes the issue. I have also added the option to trim whitespace.

- name: Embedded
  container:
    field: embedded
    format: kv
    delimiter: "\r\n\t"
    separator: '='
    trim: true       # default false
  to: HostApplication

[reece394]

This works great so I am happy to close this. Thanks again for adding this feature in!