parserContent_syslog-malwarebytes-security-alert.md

Parser Content

{
Name = syslog-malwarebytes-security-alert
    Vendor = Malwarebytes
    Product = Malwarebytes Endpoint Protection
    Lms = Direct
    DataType = "alert"
    TimeFormat = "yyyy-MM-dd'T'HH:mm:ss"
    Conditions = [ """Malwarebytes-Endpoint-Security""","\"security_log\""]
    Fields = [
        """"{1,20}time"{1,20}\s{0,100}:\s{0,100}"{1,20}({time}.+?)"{1,20}\s{0,100}[,\]\}]""",
        """"{1,20}ip_address"{1,20}\s{0,100}:\s{0,100}"{1,20}({src_ip}.+?)"{1,20}\s{0,100}[,\]\}]""",
        """"{1,20}ip_address"{1,20}\s{0,100}:\s{0,100}"{1,20}({host}.+?)"{1,20}\s{0,100}[,\]\}]""",
        """"{1,20}host_name"{1,20}\s{0,100}:\s{0,100}"{1,20}({src_host}.+?)"{1,20}\s{0,100}[,\]\}]""",
        """"{1,20}host_name"{1,20}\s{0,100}:\s{0,100}"{1,20}({host}.+?)"{1,20}\s{0,100}[,\]\}]""",
        """"{1,20}domain"{1,20}\s{0,100}:\s{0,100}"{1,20}({domain}.+?)"{1,20}\s{0,100}[,\]\}]""",
        """"{1,20}logon_user"{1,20}\s{0,100}:\s{0,100}"{1,20}(({domain}[^\\]{1,2000})\\+)?({user}.+?)"{1,20}\s{0,100}[,\]\}]""",
        """"{1,20}threat_name"{1,20}\s{0,100}:\s{0,100}"{1,20}({alert_name}.+?)"{1,20}\s{0,100}[,\]\}]""",
        """"{1,20}object_type"{1,20}\s{0,100}:\s{0,100}"{1,20}({alert_type}.+?)"{1,20}\s{0,100}[,\]\}]""",
        """"{1,20}threat_level"{1,20}\s{0,100}:\s{0,100}"({alert_severity}.+?)"{1,20}\s{0,100}[,\]\}]""",
        """"{1,20}object"{1,20}\s{0,100}:\s{0,100}"{1,20}({malware_url}.+?)"{1,20}\s{0,100}[,\]\}]""",
        """"object":"({process}[^"]{1,2000}\\({process_name}[^"]{1,2000}))""", 
    ]
  }