Writing Regex For Qradar

Writing regex for Qradar is a pretty nifty thing; task which I enjoyed the most. Qradar uses JAVA regex engine and using the 'extract property' UI window you can define really nice and complex regex as well. In this page I would like to share my tips,techniques as well some of the limitations of using regular expression in Qradar.

TIPS and SCENARIOS

1.  Consider you want to write regex for a log where you are interested to extract both success and login failures. What are your options? Consider sample custom log to be 

                            user abc Ip address 192.168.1.4 login successful.

                           user abc Ip address 192.168.1.4 login failure.

  

You got two options over here write one regex which caters for both of these events and distinguish each of them using the apply filter option in UI, or have two separate custom properties for each event and call them as you want in the search filter? 

Which option would you go for? What would be your consideration to choose any....

I myself would prefer option B for following good reasons:-

• Less post-processing which in my experience means If you got to search the above events in number of 20K log events in 1 day-depending upon your appliance,  deployment model as well hw specs means as soon as you the search completes you have the right results displayed on the screen. In other case; for every x number of record fetched from /ariel there is post-processing (front java) is involved from finding in the text (payload) the search word "failure or success" depending upon how you are going to write your search filter.

For regex part ; Here is the def

login\s+(failure)

You can test it here at rubular.