Regular Expressions 101

Community Patterns

gPat

1

Regular Expression
PCRE2 (PHP >=7.3)

/
(?'gPatSyslogPRI'<\d+>) (?'gPatMesgBody'.*) (?'gPatMesgBodyMin'.*?) (?'gPatSyslogNGHeader'\w{3}\s+\d{1,2}\s\d{1,2}:\d{1,2}:\d{1,2}\s\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) (?'gPatMon'Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec|\d{1,2}) (?'gPatMonNum'\d{1,2}) (?'gPatDay'\d{1,2}) (?'gPatTime'\d{1,2}:\d{1,2}:\d{1,2}) (?'gPatYear'\d{2,4}) (?'gPatMSec'\d{1,3}) (?'gPatTimeMSec'\d{1,2}:\d{1,2}:\d{1,2}\.\d{1,3}) (?'gPatTimeZone'Z|UTC|[+-]\d{1,2}:?\d{2}) (?'gPatWeekday'Mon|Tue|Wed|Thu|Fri|Sat|Sun) (?'gPatIpV4Dot'\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) (?'gPatIpAddr'[0-9A-Fa-f]{0,4}(?::[0-9A-Fa-f]{0,4}){1,5}:(?:\d{1,3}(?:\.\d{1,3}){3}|[0-9A-Fa-f]{0,4}(?::[0-9A-Fa-f]{0,4})?)|\d{1,3}(?:\.\d{1,3}){3}) (?'gPatIpPort'\d{1,5}) (?'gPatProto'ftp|icmp|tcp|udp|http|ip|smb|smtp|snmp|others|FTP|ICMP|UDP|TCP|HTTP|IP|SMB|SMTP|SNMP|OTHERS) (?'gPatFqdn'\w+[.\w+]+) (?'gPatWord'\w+) (?'gPatStr'[^\s]*) (?'gPatHostName'[\w.-]+) (?'gPatStrComma'[^,]*) (?'gPatStrLeftParen'[^\(]*) (?'gPatStrRightSB'[^\]]*) (?'gPatInt'\d+) (?'gPatSpace'\s+) (?'gPatStrEndColon'[^:]*) (?'gPatStrSQ'[^']*) (?'gPatStrDQ'[^']*) (?'gPatSentence'\w[\s+\w]*)
/
gm

Description

This is pre-built Global Pat for FortiSiem

Submitted by Ken - 2 years ago