Introducing SOC Insights for BloxOne Threat Defense: Boost your SOC efficiency with AI-driven insights to eliminate manual work and accelerate investigation and response times. Read the blog announcement here.

Automation Scripts

Reply

DSB - config collection - change line during collection

Authority
Posts: 4
1437     0

Hi,

 

One of our devices changes the encrypted password during config collection.

As such each collection is seen as being a new configuration to be archived.

 

I know how to complete filter those lines out with a noise filter in a custom DSB.

 

But how does the 'replace' operation work?

 

Let's take this example :

config tacacs password 1 abcdef123456 16 123456abcdef

 

I want the config collection to replace everything behind 'password 1' into 'encrypted_password'.

 

how can I do this with a custom dsb?

 

This doesn't work :-(

<processconfig vendor="Cisco" priority="101" operation="replace" line_match="\\s*config\\s+tacacs\\s+password\\s+1\\s+(\\S+\\s+\\S+\\s+\\S+)" var_match="$1" replace_val="encrypted_password" enabled="true" config_type="saved" />

 

But I can't find an example on how the replace operation works.

 

 

 

Showing results for 
Search instead for 
Did you mean: 

Recommended for You