Hi All, Are there any tools/scripts anyone has written that will convert regex to patterndb types of matches? So, given some rewrite rule from the "old" way of doing it, convert that rule to a pdb file. Like: filter f_asa { match( '(.*?):?(\d{1,3}+\.\d{1,3}+\.\d{1,3}+\.\d{1,3}+)\/(\d+)(.*?)(\).*?)?:?(\d{1,3}+\.\d{1,3}+\.\d{1,3}+\.\d{1,3}+)\/(\d+)(.*?)(\d{1,3}+\.\d{1,3}+\.\d{1,3}+\.\d{1,3}+)\/(\d+)(.*)' value("MESSAGE") type("pcre") flags("store-matches" "ignore-case") ); rewrite rw_cisco { set( "$1 SourceIP: $2 SourcePort:$3 $4 $5DestIP: $6 DestPort:$7 $8 SourceIP: $9 SourcePort:$10 $11" , value("MESSAGE") condition(filter(f_asa))); }; Convert to something like: <pattern>%ASA-6-305011: Built dynamic TCP translation from inside:@IPv4:src_ip@/@NUMBER:src_port@ to Outside:@IPv4:dst_ip@/@NUMBER:dst_port@</pattern> Note: the above is just an example, the regex may not be the same as the actual <pattern> - I just copy pasted from different files to show an example. [cid:image001.png@01D27730.889CAAF0]
