{"action":"created","issue":{"url":"https://api.github.com/repos/ossec/ossec-hids/issues/543","labels_url":"https://api.github.com/repos/ossec/ossec-hids/issues/543/labels{/name}","comments_url":"https://api.github.com/repos/ossec/ossec-hids/issues/543/comments","events_url":"https://api.github.com/repos/ossec/ossec-hids/issues/543/events","html_url":"https://github.com/ossec/ossec-hids/issues/543","id":57169954,"number":543,"title":"Regex does not seem to like single quotes","user":{"login":"ddpbsd","id":4983989,"avatar_url":"https://avatars.githubusercontent.com/u/4983989?v=3","gravatar_id":"","url":"https://api.github.com/users/ddpbsd","html_url":"https://github.com/ddpbsd","followers_url":"https://api.github.com/users/ddpbsd/followers","following_url":"https://api.github.com/users/ddpbsd/following{/other_user}","gists_url":"https://api.github.com/users/ddpbsd/gists{/gist_id}","starred_url":"https://api.github.com/users/ddpbsd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ddpbsd/subscriptions","organizations_url":"https://api.github.com/users/ddpbsd/orgs","repos_url":"https://api.github.com/users/ddpbsd/repos","events_url":"https://api.github.com/users/ddpbsd/events{/privacy}","received_events_url":"https://api.github.com/users/ddpbsd/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-02-10T12:45:13Z","updated_at":"2015-02-10T12:56:58Z","closed_at":null,"body":"While looking into the asterisk decoder issue I ran across an oddity. Using the following decoder (I have commented out all asterisk decoders past the \"asterisk\" decoder):\r\n```\r\n<decoder name=\"asterisk-denied\">\r\n  <parent>asterisk</parent>\r\n  <regex>failed for (\\S+)</regex>\r\n  <order>srcip</order>\r\n</decoder>\r\n```\r\nI get the following output:\r\n```\r\n**Phase 1: Completed pre-decoding.\r\n       full event: 'May 19 11:42:17 asterisk asterisk[5200]:\r\nNOTICE[14808]: chan_sip.c:15889 in handle_request_register:\r\nRegistration from ‘”355″<sip:355@192.168.1.60>’ failed for\r\n‘192.168.210.48’ – No matching peer found'\r\n       hostname: 'asterisk'\r\n       program_name: 'asterisk'\r\n       log: 'NOTICE[14808]: chan_sip.c:15889 in\r\nhandle_request_register: Registration from\r\n‘”355″<sip:355@192.168.1.60>’ failed for ‘192.168.210.48’ – No\r\nmatching peer found'\r\n\r\n**Phase 2: Completed decoding.\r\n       decoder: 'asterisk'\r\n       srcip: '‘192.168.210.48’'\r\n```\r\n\r\nI don't think the single quotes should still be around the srcip, so I modify the decoder:\r\n```\r\n<decoder name=\"asterisk-denied\">\r\n  <parent>asterisk</parent>\r\n  <regex>failed for '(\\S+)' </regex>\r\n  <order>srcip</order>\r\n</decoder>\r\n```\r\nThis provides the output:\r\n```\r\n**Phase 1: Completed pre-decoding.\r\n       full event: 'May 19 11:42:17 asterisk asterisk[5200]:\r\nNOTICE[14808]: chan_sip.c:15889 in handle_request_register:\r\nRegistration from ‘”355″<sip:355@192.168.1.60>’ failed for\r\n‘192.168.210.48’ – No matching peer found'\r\n       hostname: 'asterisk'\r\n       program_name: 'asterisk'\r\n       log: 'NOTICE[14808]: chan_sip.c:15889 in\r\nhandle_request_register: Registration from\r\n‘”355″<sip:355@192.168.1.60>’ failed for ‘192.168.210.48’ – No\r\nmatching peer found'\r\n\r\n**Phase 2: Completed decoding.\r\n       decoder: 'asterisk'\r\n**Phase 3: Completed filtering (rules).\r\n```\r\nEscaping the single quotes doesn't help, and \\p doesn't cover it either."},"comment":{"url":"https://api.github.com/repos/ossec/ossec-hids/issues/comments/73694712","html_url":"https://github.com/ossec/ossec-hids/issues/543#issuecomment-73694712","issue_url":"https://api.github.com/repos/ossec/ossec-hids/issues/543","id":73694712,"user":{"login":"ddpbsd","id":4983989,"avatar_url":"https://avatars.githubusercontent.com/u/4983989?v=3","gravatar_id":"","url":"https://api.github.com/users/ddpbsd","html_url":"https://github.com/ddpbsd","followers_url":"https://api.github.com/users/ddpbsd/followers","following_url":"https://api.github.com/users/ddpbsd/following{/other_user}","gists_url":"https://api.github.com/users/ddpbsd/gists{/gist_id}","starred_url":"https://api.github.com/users/ddpbsd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ddpbsd/subscriptions","organizations_url":"https://api.github.com/users/ddpbsd/orgs","repos_url":"https://api.github.com/users/ddpbsd/repos","events_url":"https://api.github.com/users/ddpbsd/events{/privacy}","received_events_url":"https://api.github.com/users/ddpbsd/received_events","type":"User","site_admin":false},"created_at":"2015-02-10T12:56:58Z","updated_at":"2015-02-10T12:56:58Z","body":"Even copy/pasting the quotes from the log message into the decoder didn't help."}}