Graylog IIS regular map two fields

Multi tool use
Multi tool use

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP



Graylog IIS regular map two fields



I'm trying to map two fields in Graylog. Right now I'm pulling IIS logs and I'm looking to match search & dashboard on IP addresses when they have 403.* errors



An example log is like this:


"EventReceivedTime":"2018-08-13 08:01:03","SourceModuleName":"iis","SourceModuleType":"im_file","date":"2018-08-12","time":"20:01:00","s-sitename":"W3SVC1","s-computername":"Portal-IIS","s-ip":"192.168.1.3","cs-method":"GET","cs-uri-stem":"/something/resource","cs-uri-query":"X-ARR-CACHE-HIT=0&SERVER-ROUTED=192.168.2.4&X-ARR-LOG-ID=b56f1f43-9cac-4356-8f03-c51b0fd5bfa1&SERVER-STATUS=403","s-port":"443","c-ip":"1.1.1.1","cs(User-Agent)":"Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.3;+WOW64;+Trident/7.0;+.NET4.0E;+.NET4.0C;+.NET+CLR+3.5.30729;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.30729;+InfoPath.3)","cs(Referer)":"https://someURL/something/resource.htm","sc-status":200,"sc-substatus":0,"sc-win32-status":0,"time-taken":0,"EventTime":"2018-08-12 20:01:00","SourceName":"IIS"



I've tried creating an extractor that would pull public IPs and the sc-status, however when toying with something like regexr, it doesn't work correctly in graylog.



How should I be approaching this problem?









By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

jiq7nNpNDPkfa yBWGzs5KlRN,LnL,0JgfLUbT4KoaWKoLX66awdxgnN e,rg F 10Z5 PC2mHpu UV8wez quVSY4VYWN pIni2E,4aZs,e
-
wbTG0RosvR6YE21PkCs7cRNbGBRKSLMy e y rSjxfZn8wwAT8My6KMiApd

Popular posts from this blog

Firebase Auth - with Email and Password - Check user already registered

Image
Clash Royale CLAN TAG #URR8PPP Firebase Auth - with Email and Password - Check user already registered I want to check when a user attempts to signup with createUserWithEmailAndPassword() in Firebase user Authentication method, this user is already registered with my app. createUserWithEmailAndPassword() 8 Answers 8 To detect whether a user with that email address already exists, you can detect when the call to createUserWithEmailAndPassword () fails with auth/email-already-in-use . I see that @Srinivasan just posted an answer for this. createUserWithEmailAndPassword () auth/email-already-in-use Alternatively, you can detect that an email address is already used by calling fetchSignInMethodsForEmail() (previous called fetchProvidersForEmail() ). fetchSignInMethodsForEmail() fetchProvidersForEmail() When the user trying to create an user with same email address, the task response will be "Response: The email address is already in use by another account." mFirebas...
Read more

Dynamically update html content plain JS

Image
Clash Royale CLAN TAG #URR8PPP Dynamically update html content plain JS So I have a script bound in my index.html, which literally has to fetch an array of jsons from an api, then dynamically update my page when get response. But as a result I'm getting an as the only update of my page. here is my script fetch(url) .then((resp) => resp.json()) .then((resp) => resp.results.forEach(item => fetch(item.url) .then((response)=> response.json()) .then((response) => pokeArr.push(response)) .catch(console.log) ) ).catch(console.log) const filler = () => if(!pokeArr) return 0 pokeArr.map((i,j)=> return `<tr>$i.name</tr>` ) const pokeindex = () => document.getElementById('a').appendChild(document.createElement(filler())) pokeindex() When I'm consoling it, I can see in the console all the responses I get, so I'm at least doing the fetching part right. What's parberakan ? What's pokeArr ? – T.J. Crowder Aug 8 at 12...
Read more

Store custom data using WC_Cart add_to_cart() method in Woocommerce 3

Image
Clash Royale CLAN TAG #URR8PPP Store custom data using WC_Cart add_to_cart() method in Woocommerce 3 I am creating a membership site and totally created static pages for each Membership plans (have only 3 plans). However, I have added products for each plan and when I hit SELECT PLAN button I redirect to some custom form where I ask users range of info we are going to use to fulfil the plan (same as sneakertub.com). I have written code into the PHP page which will handle SUBMIT action of the form. This PHP file, infopage.php , will process POST data I sent via POST call and stores these all data into WC session. infopage.php $customer_name = $_POST["customer_name"]; $customer_email = $_POST["customer_email"]; $customer_sex = $_POST["customer_sex"]; $customer_age = $_POST["customer_age"]; $product_id = $_POST["product_id"]; global $wp_session; $data = array( 'customer_name' => $customer_name, 'customer_email' =...
Read more