Search code examples
pythonregexpython-2.7snort

Regex in Python 2.7 for extraction of information from Snort log files

I'm trying to extract information from a Snort file using regular expressions. I've sucessfully got the IP's and SID, but I seem to be having trouble with extracting a specific part of the text.

How can I extract part of a Snort log file? The part I'm trying to extract can look like [Classification: example-of-attack] or [Classification: Example of Attack]. However, the first example may have any number of hyphens and whilst the second instance doesn't have any hyphens but contains some capital letters.

How could I extract just example-of-attack or Example-of-Attack?

I unfortunately only know how to search for static words such as:

test = re.search("exact-name", line)
t = test.group()
print t

I've tried many different commands on the web, but I just don't seem to get it.

Solution

  • You can use the following regex: 

    >>> m = re.search(r'\[Classification:\s*([^]]+)\]', line).group(1)

    ( Explanation | Working Demo )