Функции разбора

parse_regex(value: <строка>, pattern: <регулярное выражение>, [numeric_groups: <логическое значение>])
:: <объект>, <ошибка>

parse_regex!("Connection attempt from 192.0.2.0, from 192.0.2.1.", r'from (?P<ip>\d+\.\d+\.\d+\.\d+)')

{
  "ip": "192.0.2.0"
}

parse_regex!("Connection attempt from 192.0.2.0, from 192.0.2.1.", r'from (\d+\.\d+\.\d+\.\d+)', numeric_groups: true)

{
  "0": "from 192.0.2.0",
  "1": "192.0.2.0"
}

parse_regex_all(value: <строка>, pattern: <регулярное выражение>, [numeric_groups: <логическое значение>])
:: <массив> , <ошибка>

parse_regex_all!("Connection attempt from 192.0.2.0, from 192.0.2.1.", r'from (?P<ip>\d+\.\d+\.\d+\.\d+)', numeric_groups: true)

[
  {
    "0": "from 192.0.2.0",
    "1": "192.0.2.0",
    "ip": "192.0.2.0"
  },
  {
    "0": "from 192.0.2.1",
    "1": "192.0.2.1",
    "ip": "192.0.2.1"
  }
]

parse_apache_log(значение: <строка>, формат: <строка>, [формат_метки_времени: <строка>])
:: <объект>, <ошибка>

parse_apache_log!("127.0.0.1 bob frank [10/Oct/2000:13:55:36 -0700] \"GET /apache_pb.gif HTTP/1.0\" 200 2326", format: "common")

{
"host": "127.0.0.1",
"identity": "bob",
"user": "frank",
"timestamp": "2000-10-10T20:55:36Z",
"message": "GET /apache_pb.gif HTTP/1.0",
"method": "GET",
"path": "/apache_pb.gif",
"protocol": "HTTP/1.0",
"status": 200,
"size": 2326
}

parse_apache_log!(
s'127.0.0.1 bob frank [10/Oct/2000:13:55:36 -0700] "GET /apache_pb.gif HTTP/1.0" 200 2326 "http://www.seniorinfomediaries.com/vertical/channels/front-end/bandwidth" "Mozilla/5.0 (X11; Linux i686; rv:5.0) Gecko/1945-10-12 Firefox/37.0"',
"combined",
)

{
"host": "127.0.0.1",
"identity": "bob",
"user": "frank",
"timestamp": "2000-10-10T20:55:36Z",
"message": "GET /apache_pb.gif HTTP/1.0",
"method": "GET",
"path": "/apache_pb.gif",
"protocol": "HTTP/1.0",
"status": 200,
"size": 2326,
"referrer": "http://www.seniorinfomediaries.com/vertical/channels/front-end/bandwidth",
"agent": "Mozilla/5.0 (X11; Linux i686; rv:5.0) Gecko/1945-10-12 Firefox/37.0"
}

parse_apache_log!(
s'[01/Mar/2021:12:00:19 +0000] [ab:alert] [pid 4803:tid 3814] [client 147.159.108.175:24259] I will bypass the haptic COM bandwidth, that should matrix the CSS driver!',
"error"
)

{
"client": "147.159.108.175",
"message": "I will bypass the haptic COM bandwidth, that should matrix the CSS driver!",
"module": "ab",
"pid": 4803,
"port": 24259,
"severity": "alert",
"thread": "3814",
"timestamp": "2021-03-01T12:00:19Z"
}

rv_parse_avro(значение: <строка>, [reader_schema: <строка>])
:: <массив объектов>, <ошибка>

rv_parse_avro!(.message)

"массив объектов"

rv_parse_avro!(.message, reader_schema: "{"type": "record", "fields" : [{ "name" : "test" , "type" : "string" }]}")

[{test: "value"}]

rv_parse_avro_raw(значение: <строка>, decoder_schema: <avro_schema>, [reader_schema: <строка>])
:: <объект>, <ошибка>

rv_parse_avro_raw!(.message, decoder_schema: "{"type": "record", "fields" : [{ "name" : "test" , "type" : "string" }, { "name" : "test2" , "type" : "string" }]}")

{test: "value", test2: "value"}"

parse_avro_raw!(.message, decoder_schema: s'{"type": "record", "fields" : [{ "name" : "test" , "type" : "string" }, { "name" : "test2" , "type" : "string" }]}', reader_scheme: s'{"type": "record", "fields" : [{ "name" : "test" , "type" : "string" }]}')

{test: "value"}

parse_aws_alb_log(значение: <строка>)
:: <объект>, <ошибка>

parse_aws_alb_log!(
"http 2018-11-30T22:23:00.186641Z app/my-loadbalancer/50dc6c495c0c9188 192.168.131.39:2817 - 0.000 0.001 0.000 200 200 34 366 \"GET http://www.example.com:80/ HTTP/1.1\" \"curl/7.46.0\" - - arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067 \"Root=1-58337364-23a8c76965a2ef7629b185e3\" \"-\" \"-\" 0 2018-11-30T22:22:48.364000Z \"forward\" \"-\" \"-\" \"-\" \"-\" \"-\" \"-\""
)

{
"type": "http",
"timestamp": "2018-11-30T22:23:00.186641Z",
"elb": "app/my-loadbalancer/50dc6c495c0c9188",
"client_host": "192.168.131.39:2817",
"target_host": null,
"request_processing_time": 0,
"target_processing_time": 0.001,
"response_processing_time": 0,
"elb_status_code": "200",
"target_status_code": "200",
"received_bytes": 34,
"sent_bytes": 366,
"request_method": "GET",
"request_url": "http://www.example.com:80/",
"request_protocol": "HTTP/1.1",
"user_agent": "curl/7.46.0",
"ssl_cipher": null,
"ssl_protocol": null,
"target_group_arn": "arn:aws:elasticloadbalancing:us-east-2:123456789012:targetgroup/my-targets/73e2d6bc24d8a067",
"trace_id": "Root=1-58337364-23a8c76965a2ef7629b185e3",
"domain_name": null,
"chosen_cert_arn": null,
"matched_rule_priority": "0",
"request_creation_time": "2018-11-30T22:22:48.364000Z",
"actions_executed": "forward",
"redirect_url": null,
"error_reason": null,
"target_port_list": [],
"target_status_code_list": [],
"classification": null,
"classification_reason": null
}

parse_aws_cloudwatch_log_subscription_message(значение: <строка>)
:: <объект>, <ошибка>

parse_aws_cloudwatch_log_subscription_message!(.message)

{
"owner": "111111111111",
"message_type": "DATA_MESSAGE",
"log_group": "test",
"log_stream": "test",
"subscription_filters": [
"Destination"
],
"log_events": [
{
"id": "35683658089614582423604394983260738922885519999578275840",
"message": "{\"bytes\":26780,\"datetime\":\"14/Sep/2020:11:45:41 -0400\",\"host\":\"157.130.216.193\",\"method\":\"PUT\",\"protocol\":\"HTTP/1.0\",\"referer\":\"https://www.principalcross-platform.io/markets/ubiquitous\",\"request\":\"/expedite/convergence\",\"source_type\":\"stdin\",\"status\":301,\"user-identifier\":\"-\"}",
"timestamp": "2020-09-14T19:09:29.039Z"
}
]
}

parse_aws_vpc_flow_log(значение: <строка>, [формат: <строка>])
:: <объект> , <ошибка>

parse_aws_vpc_flow_log!("2 123456789010 eni-1235b8ca123456789 - - - - - - 1431280876 1431280934 - NODATA")

{
"version": 2,
"account_id": 123456789010,
"interface_id": "eni-1235b8ca123456789",
"srcaddr": null,
"dstaddr": null,
"srcport": null,
"dstport": null,
"protocol": null,
"packets": null,
"bytes": null,
"start": 1431280876,
"end": 1431280934,
"action": null,
"log_status": "NODATA"
}

parse_aws_vpc_flow_log!(
"- eni-1235b8ca123456789 10.0.1.5 10.0.0.220 10.0.1.5 203.0.113.5",
"instance_id interface_id srcaddr dstaddr pkt_srcaddr pkt_dstaddr"
)

{
"instance_id": null,
"interface_id": "eni-1235b8ca123456789",
"srcaddr": "10.0.1.5",
"dstaddr": "10.0.0.220",
"pkt_srcaddr": "10.0.1.5",
"pkt_dstaddr": "203.0.113.5"
}

parse_cef(значение: <строка>, [translate_custom_fields: <логическое значение>])
:: <объект> , <ошибка>

parse_cef!(
"CEF:0|CyberArk|PTA|12.6|1|Suspected credentials theft|8|suser=mike2@prod1.domain.com shost=prod1.domain.com src=1.1.1.1 duser=andy@dev1.domain.com dhost=dev1.domain.com dst=2.2.2.2 cs1Label=ExtraData cs1=None cs2Label=EventID cs2=52b06812ec3500ed864c461e deviceCustomDate1Label=detectionDate deviceCustomDate1=1388577900000 cs3Label=PTAlink cs3=https://1.1.1.1/incidents/52b06812ec3500ed864c461e cs4Label=ExternalLink cs4=None"
)

{
"cefVersion": "0",
"deviceVendor": "CyberArk",
"deviceProduct": "PTA",
"deviceVersion": "12.6",
"deviceEventClassId": "1",
"name": "Suspected credentials theft",
"severity": "8",
"suser": "mike2@prod1.domain.com",
"shost": "prod1.domain.com",
"src": "1.1.1.1",
"duser": "andy@dev1.domain.com",
"dhost": "dev1.domain.com",
"dst": "2.2.2.2",
"cs1Label": "ExtraData",
"cs1": "None",
"cs2Label": "EventID",
"cs2": "52b06812ec3500ed864c461e",
"deviceCustomDate1Label": "detectionDate",
"deviceCustomDate1": "1388577900000",
"cs3Label": "PTAlink",
"cs3": "https://1.1.1.1/incidents/52b06812ec3500ed864c461e",
"cs4Label": "ExternalLink",
"cs4": "None"
}

parse_cef!(
"Sep 29 08:26:10 host CEF:1|Security|threatmanager|1.0|100|worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2 spt=1232"
)

{
"cefVersion": "1",
"deviceVendor": "Security",
"deviceProduct": "threatmanager",
"deviceVersion": "1.0",
"deviceEventClassId": "100",
"name": "worm successfully stopped",
"severity": "10",
"src": "10.0.0.1",
"dst": "2.1.2.2",
"spt": "1232"
}

parse_cef!(
"CEF:0|Dev|firewall|2.2|1|Connection denied|5|c6a1=2345:0425:2CA1:0000:0000:0567:5673:23b5 c6a1Label=Device IPv6 Address",
translate_custom_fields: true
)

{
"cefVersion": "0",
"deviceVendor": "Dev",
"deviceProduct": "firewall",
"deviceVersion": "2.2",
"deviceEventClassId": "1",
"name": "Connection denied",
"severity": "5",
"Device IPv6 Address": "2345:0425:2CA1:0000:0000:0567:5673:23b5"
}

rv_parse_cef(значение: <строка>)
:: <объект>, <ошибка>

rv_parse_cef!(s'CEF:0|Microsoft|Microsoft Windows||Microsoft-Windows-Security-Auditing:4624|An account was successfully logged on.|Low| eventId=1013540004 externalId=4624')

{
    "deviceVendor": "Microsoft",
    "deviceProduct": "Microsoft Windows",
    "deviceVersion": "",
    "deviceEventClassId": "Microsoft-Windows-Security-Auditing:4624",
    "name": "An account was successfully logged on.",
    "severity": "Low",
    "eventId": "1013540004",
    "externalId": "4624"
}

value = r#"<134>1 2022-02-14T03:17:30-08:00 TEST CEF:0|Vendor|Product|20.0.560|600|User Signed In|3|src=127.0.0.1 "#
rv_parse_cef!(value)

{
    ahost: "TEST",
    at: "2022-02-14T03:17:30-08:00",
    deviceProduct: "Product",
    deviceVendor: "Vendor",
    deviceVersion: "20.0.560",
    name: "User Signed In",
    severity: "3",
    signatureId: "600",
    src: "127.0.0.1",
    syslog_facility: "16",
    syslog_priority: "134",
    syslog_severity: "6",
})

parse_common_log(значение: <строка>, [формат_метки_времени: <строка>])
:: <объект> , <ошибка>

parse_common_log!("127.0.0.1 bob frank [10/Oct/2000:13:55:36 -0700] \"GET /apache_pb.gif HTTP/1.0\" 200 2326")

{
"host": "127.0.0.1",
"identity": "bob",
"user": "frank",
"timestamp": "2000-10-10T20:55:36Z",
"message": "GET /apache_pb.gif HTTP/1.0",
"method": "GET",
"path": "/apache_pb.gif",
"protocol": "HTTP/1.0",
"status": 200,
"size": 2326
}

parse_common_log!(
"127.0.0.1 bob frank [2000-10-10T20:55:36Z] \"GET /apache_pb.gif HTTP/1.0\" 200 2326",
"%+"
)

{
"host": "127.0.0.1",
"identity": "bob",
"user": "frank",
"timestamp": "2000-10-10T20:55:36Z",
"message": "GET /apache_pb.gif HTTP/1.0",
"method": "GET",
"path": "/apache_pb.gif",
"protocol": "HTTP/1.0",
"status": 200,
"size": 2326
}

rv_extract_from_dit(значение: <строка>)
:: <строка>, <ошибка>

extract_from_dit("CN=Dev-India,OU=Distribution Groups,DC=gp,DC=gl,DC=example,DC=com"

{"username": "dev-india", "domain": "gp.gl.example.com"}

parse_glog(значение: <строка>)
:: <объект> , <ошибка>

parse_glog!("I20210131 14:48:54.411655 15520 main.c++:9] Hello world!")

{
"level": "info",
"timestamp": "2021-01-31T14:48:54.411655Z",
"id": 15520,
"file": "main.c++",
"line": 9,
"message": "Hello world!"
}

parse_grok(значение: <строка>, pattern: <строка>)
:: <объект> , <ошибка>

parse_grok!(
"2020-10-02T23:22:12.223222Z info Hello world",
"%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:level} %{GREEDYDATA:message}"
)

{
"timestamp": "2020-10-02T23:22:12.223222Z",
"level": "info",
"message": "Hello world"
}

parse_groks(значение: <строка>, patterns: <массив>, [aliases: <объект>])
:: <объект> , <ошибка>

parse_groks!(
"2020-10-02T23:22:12.223222Z info Hello world",
patterns: [
"%{common_prefix} %{_status} %{_message}",
"%{common_prefix} %{_message}",
],
aliases: {
"common_prefix": "%{_timestamp} %{_loglevel}",
"_timestamp": "%{TIMESTAMP_ISO8601:timestamp}",
"_loglevel": "%{LOGLEVEL:level}",
"_status": "%{POSINT:status}",
"_message": "%{GREEDYDATA:message}"
}
)

{
"timestamp": "2020-10-02T23:22:12.223222Z",
"level": "info",
"message": "Hello world"
}

parse_klog(значение: <строка>)
:: <объект> , <ошибка>

parse_klog!("I0505 17:59:40.692994 28133 klog.go:70] hello from klog")

{
"file": "klog.go",
"id": 28133,
"level": "info",
"line": 70,
"message": "hello from klog",
"timestamp": "2023-05-05T17:59:40.692994Z"
}

rv_parse_leef(значение: <строка>)
:: <объект>, <ошибка>

rv_parse_leef!("<13>1 2024-07-18T11:07:53.520Z 192.168.1.1 LEEF:2.0|Microsoft|MSExchange|2007|7732|^|dvchost=www.example.com^msg=io\t|p")

{
    "syslog_facility": "1",
    "syslog_priority": "13",
    "syslog_severity": "5",
    "at": "2024-07-18T11:07:53.520Z",
    "ahost": "192.168.1.1",
    "dvchost": "www.example.com",
    "msg": "io\t|p",
    "deviceVendor": "Microsoft",
    "eventName": "7732",
    "productName": "MSExchange",
    "productVersion": "2007",
}

parse_linux_authorization(значение: <строка>)
:: <объект> , <ошибка>

parse_linux_authorization!(
s'Mar 23 01:49:58 localhost sshd[1111]: Accepted publickey for eng from 10.1.1.1 port 8888 ssh2: RSA SHA256:foobar'
)

{
"appname": "sshd",
"hostname": "localhost",
"message": "Accepted publickey for eng from 10.1.1.1 port 8888 ssh2: RSA SHA256:foobar",
"procid": 1111,
"timestamp": "2023-03-23T01:49:58Z"
}

parse_logfmt(значение: <строка>)
:: <объект> , <ошибка>

parse_logfmt!(
"@timestamp=\"Sun Jan 10 16:47:39 EST 2021\" level=info msg=\"Stopping all fetchers\" tag#production=stopping_fetchers id=ConsumerFetcherManager-1382721708341 module=kafka.consumer.ConsumerFetcherManager"
)

{
"@timestamp": "Sun Jan 10 16:47:39 EST 2021",
"level": "info",
"msg": "Stopping all fetchers",
"tag#production": "stopping_fetchers",
"id": "ConsumerFetcherManager-1382721708341",
"module": "kafka.consumer.ConsumerFetcherManager"
}

rv_parse_msgpack(значение: <строка>)
:: <объект>, <ошибка>

rv_parse_msgpack!([
    135, 163, 105, 110, 116, 1, 165, 102, 108, 111, 97, 116, 203, 63, 224, 0, 0, 0, 0, 0, 0,
    167, 98, 111, 111, 108, 101, 97, 110, 195, 164, 110, 117, 108, 108, 192, 166, 115, 116,
    114, 105, 110, 103, 167, 102, 111, 111, 32, 98, 97, 114, 165, 97, 114, 114, 97, 121, 146,
    163, 102, 111, 111, 163, 98, 97, 114, 166, 111, 98, 106, 101, 99, 116, 130, 163, 102, 111,
    111, 1, 163, 98, 97, 122, 203, 63, 224, 0, 0, 0, 0, 0, 0,
])

{
    "int": 1,
    "float": 0.5,
    "boolean": true,
    "null": null,
    "string": "foo bar",
    "array": [
        "foo",
        "bar"
    ],
    "object": {
        "foo": 1,
        "baz": 0.5
}

rv_parse_msgpack!(decode_base64!("3wAAAAGlZmllbGSldmFsdWU="))

{"field": "value"}

rv_parse_msgpack_batch(значение: <строка>)
:: <массив объектов>, <ошибка>

rv_parse_msgpack_batch!([
    135, 163, 105, 110, 116, 1, 165, 102, 108, 111, 97, 116, 203, 63, 224, 0, 0, 0, 0, 0, 0,
    167, 98, 111, 111, 108, 101, 97, 110, 195, 164, 110, 117, 108, 108, 192, 166, 115, 116,
    114, 105, 110, 103, 167, 102, 111, 111, 32, 98, 97, 114, 165, 97, 114, 114, 97, 121, 146,
    163, 102, 111, 111, 163, 98, 97, 114, 166, 111, 98, 106, 101, 99, 116, 130, 163, 102, 111,
    111, 1, 163, 98, 97, 122, 203, 63, 224, 0, 0, 0, 0, 0, 0,
    135, 163, 105, 110, 116, 1, 165, 102, 108, 111, 97, 116, 203, 63, 224, 0, 0, 0, 0, 0, 0,
    167, 98, 111, 111, 108, 101, 97, 110, 195, 164, 110, 117, 108, 108, 192, 166, 115, 116,
    114, 105, 110, 103, 167, 102, 111, 111, 32, 98, 97, 114, 165, 97, 114, 114, 97, 121, 146,
    163, 102, 111, 111, 163, 98, 97, 114, 166, 111, 98, 106, 101, 99, 116, 130, 163, 102, 111,
    111, 1, 163, 98, 97, 122, 203, 63, 224, 0, 0, 0, 0, 0, 0,
])

[{
    "int": 1,
    "float": 0.5,
    "boolean": true,
    "null": null,
    "string": "foo bar",
    "array": [
        "foo",
        "bar"
    ],
    "object": {
        "foo": 1,
        "baz": 0.5
    }
},
{
    "int": 1,
    "float": 0.5,
    "boolean": true,
    "null": null,
    "string": "foo bar",
    "array": [
        "foo",
        "bar"
    ],
    "object": {
        "foo": 1,
        "baz": 0.5
    }
}]

rv_parse_msgpack!(decode_base64!("3wAAAAGlZmllbGSldmFsdWXfAAAAAaVmaWVsZKV2YWx1ZQ=="))

[{"field": "value"}, {"field": "value"}]

rv_parse_netflow(значение: <строка>)
:: <массив объектов>, <ошибка>

rv_parse_netflow!(decode_base64!("AAUCAAMABAAFAAYHCAkAAQIDBAUGBwgJAAECAwQFBgcICQABAgMEBQYHCAkAAQIDBAUGBwgJAAECAwQFBgcICQABAgMEBQYH"))

[
  {
    "V5": {
      "body": {
        "d_octets": 66051,
        "d_pkts": 101124105,
        "dst_addr": "4.5.6.7",
        "dst_as": 515,
        "dst_mask": 5,
        "dst_port": 1029,
        "first": {
          "nanos": 87000000,
          "secs": 67438
        },
        "input": 515,
        "last": {
          "nanos": 553000000,
          "secs": 134807
        },
        "next_hop": "8.9.0.1",
        "output": 1029,
        "pad1": 6,
        "pad2": 1543,
        "protocol_number": 8,
        "protocol_type": "EGP",
        "src_addr": "0.1.2.3",
        "src_as": 1,
        "src_mask": 4,
        "src_port": 515,
        "tcp_flags": 7,
        "tos": 9
      },
      "header": {
        "count": 512,
        "engine_id": 7,
        "engine_type": 6,
        "flow_sequence": 33752069,
        "sampling_interval": 2057,
        "sys_up_time": {
          "nanos": 672000000,
          "secs": 50332
        },
        "unix_nsecs": 134807553,
        "unix_secs": 83887623,
        "version": 5
      }
    }
  }
]

parse_nginx_log(значение: <строка>, формат: <строка>, [формат_метки_времени: <строка>])
:: <объект> , <ошибка>

parse_nginx_log!(
s'172.17.0.1 - alice [01/Apr/2021:12:02:31 +0000] "POST /not-found HTTP/1.1" 404 153 "http://localhost/somewhere" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.119 Safari/537.36" "2.75"',
"combined",
)

{
"client": "172.17.0.1",
"user": "alice",
"timestamp": "2021-04-01T12:02:31Z",
"request": "POST /not-found HTTP/1.1",
"method": "POST",
"path": "/not-found",
"protocol": "HTTP/1.1",
"status": 404,
"size": 153,
"referer": "http://localhost/somewhere",
"agent": "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.119 Safari/537.36",
"compression": "2.75"
}

parse_nginx_log!(
s'2021/04/01 13:02:31 [error] 31#31: *1 open() "/usr/share/nginx/html/not-found" failed (2: No such file or directory), client: 172.17.0.1, server: localhost, request: "POST /not-found HTTP/1.1", host: "localhost:8081"',
"error"
)

{
"timestamp": "2021-04-01T13:02:31Z",
"severity": "error",
"pid": 31,
"tid": 31,
"cid": 1,
"message": "open() \"/usr/share/nginx/html/not-found\" failed (2: No such file or directory)",
"client": "172.17.0.1",
"server": "localhost",
"request": "POST /not-found HTTP/1.1",
"host": "localhost:8081"
}

parse_proto(значение: <строка>, файл_дескрипторов: <строка>, тип_сообщения: <строка>)
:: <объект>, <ошибка>

.payload = encode_base64(encode_proto!({"name": "someone", "phones": [{"number": "123456"}]}, "resources/protobuf_descriptor_set.desc", "test_protobuf.Person"))

Cgdzb21lb25lIggKBjEyMzQ1Ng==

rv_parse_qradar(значение: <строка>)
:: <объект>, <ошибка>

rv_parse_msgpack!("AgentDevice=WindowsLog\tAgentLogFile=Security\tPluginVersion=7.2.9.105\tSource=Microsoft-Windows-Security-Auditing\tComputer=dc04.lab2012.local\tOriginatingComputer=192.0.2.0\tUser=\tDomain=\tEventID=4624\tEventIDCode=4624\tEventType=8\tEventCategory=12544\tRecordNumber=11103971\tTimeGenerated=1610705793\tTimeWritten=1610705793\tLevel=Log Always\tKeywords=Audit Success\tTask=SE_ADT_LOGON_LOGON\tOpcode=Info\tMessage=Вход с учетной записью выполнен успешно.  Субъект:  ИД безопасности:  NULL SID  Имя учетной записи:  -  Домен учетной записи:  -  Код входа:  0x0  Тип входа:   3  Уровень олицетворения:  Делегирование  Новый вход:  ИД безопасности:  NT AUTHORITY\\СИСТЕМА  Имя учетной записи:  USER  Домен учетной записи:  LAB2012  Код входа:  0x1E6112B9  GUID входа:  {06457096-03A4-55FB-28EA-9882B565E681}  Сведения о процессе:  Идентификатор процесса:  0x0  Имя процесса:  -  Сведения о сети:  Имя рабочей станции: -  Сетевой адрес источника: fe80::7830:1b00:4e5f:1300  Порт источника:  51755  Данное событие возникает при создании сеанса входа.\n".as_bytes())

{
    "AgentDevice": "WindowsLog",
    "AgentLogFile": "Security",
    "PluginVersion": "7.2.9.105",
    "Source": "Microsoft-Windows-Security-Auditing",
    "Computer": "dc04.lab2012.local",
    "OriginatingComputer": "192.0.2.0"
    "User": ""
    "Domain": ""
    "EventID": "4624"
    "EventIDCode": "4624"
    "EventType": "8"
    "EventCategory": "12544"
    "RecordNumber": "11103971"
    "TimeGenerated": "1610705793"
    "TimeWritten": "1610705793"
    "Level": "Log Always"
    "Keywords": "Audit Success"
    "Task": "SE_ADT_LOGON_LOGON"
    "Opcode": "Info"
    "Message": {
        "Вход с учетной записью выполнен успешно.": "",
        "Субъект": "ИД безопасности: NULL SID",
        "Имя учетной записи": "-",
        "Домен учетной записи": "-",
        "Код входа": "0x0",
        "Тип входа": "3",
        "Уровень олицетворения": "Делегирование",
        "Новый вход": {
            "ИД безопасности": "NT AUTHORITY\\СИСТЕМА",
            "Имя учетной записи": "USER",
            "Домен учетной записи": "LAB2012",
            "Код входа": "0x1E6112B9",
            "GUID входа": "{06457096-03A4-55FB-28EA-9882B565E681}"
        },
        "Сведения о процессе": {
            "Идентификатор процесса": "0x0",
            "Имя процесса": "-"
        },
        "Сведения о сети": {
            "Имя рабочей станции": "-",
            "Сетевой адрес источника": "2001:DB8::7830:1b00:4e5f:1300",
            "Порт источника": "51755"
        }
    }
}

rv_parse_msgpack!("<13>Jan 15 13:16:35 DC04  AgentDevice=WindowsLog\tAgentLogFile=Security\tPluginVersion=7.2.9.105\tSource=Microsoft-Windows-Security-Auditing\tComputer=dc04.lab2012.local\tOriginatingComputer=192.0.2.0\tUser=\tDomain=\tEventID=4624\tEventIDCode=4624\tEventType=8\tEventCategory=12544\tRecordNumber=11103971\tTimeGenerated=1610705793\tTimeWritten=1610705793\tLevel=Log Always\tKeywords=Audit Success\tTask=SE_ADT_LOGON_LOGON\tOpcode=Info\n".as_bytes())

{
    "syslog_facility": "1",
    "syslog_priority": "13",
    "syslog_severity": "5",
    "at": "Jan 15 13:16:35",
    "ahost": "DC04",
    "AgentDevice": "WindowsLog",
    "AgentLogFile": "Security",
    "PluginVersion": "7.2.9.105",
    "Source": "Microsoft-Windows-Security-Auditing",
    "Computer": "dc04.lab2012.local",
    "OriginatingComputer": "192.0.2.0"
    "User": ""
    "Domain": ""
    "EventID": "4624"
    "EventIDCode": "4624"
    "EventType": "8"
    "EventCategory": "12544"
    "RecordNumber": "11103971"
    "TimeGenerated": "1610705793"
    "TimeWritten": "1610705793"
    "Level": "Log Always"
    "Keywords": "Audit Success"
    "Task": "SE_ADT_LOGON_LOGON"
    "Opcode": "Info"
}

parse_syslog(значение: <строка>)
:: <объект> , <ошибка>

parse_syslog!(
s'<13>1 2020-03-13T20:45:38.119Z dynamicwireless.name non 2426 ID931 [exampleSDID@32473 iut="3" eventSource= "Application" eventID="1011"] Try to override the THX port, maybe it will reboot the neural interface!'
)

{
"severity": "notice",
"facility": "user",
"timestamp": "2020-03-13T20:45:38.119Z",
"hostname": "dynamicwireless.name",
"appname": "non",
"procid": 2426,
"msgid": "ID931",
"message": "Try to override the THX port, maybe it will reboot the neural interface!",
"exampleSDID@32473": {
"eventID": "1011",
"eventSource": "Application",
"iut": "3"
},
"version": 1
}

to_syslog_facility(значение: <целое число>)
:: <строка> , <ошибка>

to_syslog_facility!(4)

auth

to_syslog_level(значение: <целое число>)
:: <строка> , <ошибка>

to_syslog_level!(5)

notice

to_syslog_severity(значение: <строка>)
:: <целое число> , <ошибка>

to_syslog_severity!("alert")

1

parse_csv(значение: <строка>, [delimiter: <строка>])
:: <массив> , <ошибка>

parse_csv!("foo,bar,\"foo \"\", bar\"")

[ "foo", "bar", "foo \", bar"]

parse_csv!("foo bar", delimiter: " ")

[ "foo", "bar"]

rv_parse_html(значение: <строка>, [trim: <логическое значение>, attr_prefix: <строка>, text_key: <строка>, always_use_text_key: <логическое значение>, parse_bool: <логическое значение>, parse_null: <логическое значение>, parse_number: <логическое значение>])
:: <объект>, <ошибка>

value = r"<book category="PROGRAMMING"> <title lang="en">The Rust programming language</title> <author>Steve Klabnik, Carol Nichols</author> <year>2019</year></book>"
rv_parse_html!(value, text_key: "value", parse_number: false)

{ "book":
{ "@category": "PROGRAMMING",
"author": "Steve Klabnik, Carol Nichols",
"title":
{ "@lang": "en",
"value": "The Rust programming language"
},
"year": "2019"
}
}

value = r#"<b>test</b>"#
rv_parse_html!(value, text_key: "value", text_key: "node", always_use_text_key: true)

{ "b": { "node": "test" } }

value = r#"<root>  <a>test</a>  </root>#
rv_parse_html!(value, trim: false)

{
    "root": {
        "a": "test",
        "text": ["  ", "  "],
    }
}

parse_json(значение: <строка>, [max_depth: <целое число>])
:: <логическое значение | целое число | число с плавающей точкой | строка | объект | массив | пустое значение> , <ошибка>

parse_json!("{\"key\": \"val\"}")

{
"key": "val"
}

parse_json!("{\"top_level\":{\"key\": \"val\"}}", max_depth: 1)

{
"top_level": "{\"key\": \"val\"}"
}

rv_json_extract_payload(значение: <строка>, payload_key: <строка>)
:: <логическое значение | целое число | число с плавающей точкой | строка | объект | массив | пустое значение>, <ошибка>

rv_json_extract_payload(s'{"a": 123, "payload"    : "data"}', payload_key: "payload")

"data"

rv_json_extract_payload(s'"asd":123,"payload" : "text"', payload_key: "payload")

"text"

rv_json_extract_payload(s'{ asd":123,"payload" : "first", "payload": "second" }', payload_key: "payload")

"first"

parse_key_value(значение: <строка>, [key_value_delimiter: <строка>, field_delimiter: <строка>, whitespace: <строка>, accept_standalone_key: <логическое значение>])
:: <объект> , <ошибка>

parse_key_value!(
"@timestamp=\"Sun Jan 10 16:47:39 EST 2021\" level=info msg=\"Stopping all fetchers\" tag#production=stopping_fetchers id=ConsumerFetcherManager-1382721708341 module=kafka.consumer.ConsumerFetcherManager"
)

{
"@timestamp": "Sun Jan 10 16:47:39 EST 2021",
"level": "info",
"msg": "Stopping all fetchers",
"tag#production": "stopping_fetchers",
"id": "ConsumerFetcherManager-1382721708341",
"module": "kafka.consumer.ConsumerFetcherManager"
}

parse_key_value!(
"path:\"/cart_link\", host:store.app.com, fwd: \"102.30.171.16\", dyno: web.1, connect:0ms, service:87ms, status:304, bytes:632, protocol:https",
field_delimiter: ",",
key_value_delimiter: ":"
)

{
"path": "/cart_link",
"host": "store.app.com",
"fwd": "102.30.171.16",
"dyno": "web.1",
"connect": "0ms",
"service": "87ms",
"status": "304",
"bytes": "632",
"protocol": "https"
}

parse_key_value!(
"env:prod,service:backend,region:eu-east1,beta",
field_delimiter: ",",
key_value_delimiter: ":",
)

{
"env": "prod",
"service": "backend",
"region": "eu-east1",
"beta": true
}

parse_key_value!(
"at=info,method=GET,path=\"/index\",status=200,tags=dev,tags=dummy",
field_delimiter: ",",
key_value_delimiter: "=",
)

{
"at": "info",
"method": "GET",
"path": "/index",
"status": "200",
"tags": [
"dev",
"dummy"
]
}

parse_ruby_hash(значение: <строка>)
:: <объект> , <ошибка>

parse_ruby_hash!(s'{ "test" => "value", "testNum" => 0.2, "testObj" => { "testBool" => true, "testNull" => nil } }')

{
"test": "value",
"testNum": 0.2,
"testObj": {
"testBool": true,
"testNull": null
}
}

parse_xml(значение: <строка>, [include_attr: <логическое значение>, attr_prefix: <строка>, text_key: <строка>, always_use_text_key: <логическое значение>, parse_bool: <логическое значение>, parse_null: <логическое значение>, parse_number: <логическое значение>])
:: <объект> , <ошибка>

value = s'<book category="CHILDREN"><title lang="en">Harry Potter</title><author>J K. Rowling</author><year>2005</year></book>';


parse_xml!(value, text_key: "value", parse_number: false)

{
"book": {
"@category": "CHILDREN",
"author": "J K. Rowling",
"title": {
"@lang": "en",
"value": "Harry Potter"
},
"year": "2005"
}
}

parse_duration(значение: <строка>, unit: <строка>)
:: <число с плавающей точкой> , <ошибка>

parse_duration!("1005ms", unit: "s")

1.005

parse_query_string(значение: <строка>)
:: <объект>

parse_query_string("foo=%2B1&bar=2&bar=3&xyz")

{
"foo": "+1",
"bar": [
"2",
"3"
],
"xyz": ""
}

parse_query_string("?foo%5b%5d=1&foo%5b%5d=2")

{
"foo[]": [
"1",
"2"
]
}

parse_tokens(значение: <строка>)
:: <массив> , <ошибка>

parse_tokens(
"A sentence \"with \\\"a\\\" sentence inside\" and [some brackets]"
)

[
"A",
"sentence",
"with \\\"a\\\" sentence inside",
"and",
"some brackets"
]

parse_url(значение: <строка>, [default_known_ports: <логическое значение>])
:: <объект> , <ошибка>

parse_url!("ftp://foo:bar@example.com:4343/foobar?hello=world#123")

{
"scheme": "ftp",
"username": "foo",
"password": "bar",
"host": "example.com",
"port": 4343,
"path": "/foobar",
"query": {
"hello": "world"
},
"fragment": "123"
}

parse_url!("https://example.com", default_known_ports: true)

{
"scheme": "https",
"username": "",
"password": "",
"host": "example.com",
"port": 443,
"path": "/",
"query": {},
"fragment": null
}

parse_user_agent(значение: <строка>, [mode: <строка>])
:: <объект>

parse_user_agent(
"Mozilla Firefox 1.0.1 Mozilla/5.0 (X11; U; Linux i686; de-DE; rv:1.7.6) Gecko/20050223 Firefox/1.0.1"
)

{
"browser": {
"family": "Firefox",
"version": "1.0.1"
},
"device": {
"category": "pc"
},
"os": {
"family": "Linux",
"version": null
}
}

parse_user_agent(
"Mozilla/4.0 (compatible; MSIE 7.66; Windows NT 5.1; SV1; .NET CLR 1.1.4322)",
mode: "reliable"
)

{
"browser": {
"family": "Internet Explorer",
"version": "7.66"
},
"device": {
"category": "pc"
},
"os": {
"family": "Windows XP",
"version": "NT 5.1"
}
}

parse_user_agent(
"Opera/9.80 (J2ME/MIDP; Opera Mini/4.3.24214; iPhone; CPU iPhone OS 4_2_1 like Mac OS X; AppleWebKit/24.783; U; en) Presto/2.5.25 Version/10.54",
mode: "enriched"
)

{
"browser": {
"family": "Opera Mini",
"major": "4",
"minor": "3",
"patch": "24214",
"version": "10.54"
},
"device": {
"brand": "Apple",
"category": "smartphone",
"family": "iPhone",
"model": "iPhone"
},
"os": {
"family": "iOS",
"major": "4",
"minor": "2",
"patch": "1",
"patch_minor": null,
"version": "4.2.1"
}
}

ip_aton(значение: <строка>)
:: <целое число> , <ошибка>

ip_aton!("1.2.3.4")

16909060

ip_cidr_contains(cidr: <строка>, ip: <строка>)
:: <логическое значение> , <ошибка>

ip_cidr_contains!("192.168.0.0/16", "192.168.10.32")

true

ip_cidr_contains!("2001:4f8:4:ba::/64", "2001:4f8:4:ba:2e0:81ff:fe22:d1f1")

true

ip_ntoa(значение: <строка>)
:: <строка> , <ошибка>

ip_ntoa!(16909060)

1.2.3.4

ip_ntop(значение: <строка>)
:: <строка> , <ошибка>

ip_ntop!(decode_base64!("wKgAAQ=="))

192.168.0.1

ip_ntop!(decode_base64!("IAENuIWjAAAAAIouA3BzNA=="))

2001:db8:85a3::8a2e:370:7334

ip_pton(значение: <строка>)
:: <строка> , <ошибка>

encode_base64(ip_pton!("192.168.0.1"))

wKgAAQ==

encode_base64(ip_pton!("2001:db8:85a3::8a2e:370:7334"))

IAENuIWjAAAAAIouA3BzNA==

ip_subnet(ip: <строка>, подсеть: <строка>)
:: <строка> , <ошибка>

ip_subnet!("192.168.10.32", "255.255.255.0")

192.168.10.0

ip_subnet!("2404:6800:4003:c02::64", "/32")

2404:6800::

ip_to_ipv6(ip: <строка>)
:: <строка> , <ошибка>

ip_to_ipv6!("192.168.10.32")

::ffff:192.168.10.32

ipv6_to_ipv4(ip: <строка>)
:: <строка> , <ошибка>

ipv6_to_ipv4!("::ffff:192.168.0.1")

192.168.0.1