Infoblox’s global team of threat hunters uncovers a DNS operation with the ability to bypass traditional security measures and control the Great Firewall of China. Read about “Muddling Meerkat” and the many other threat actors discovered by Infoblox Threat Intel here.

Automation Scripts

Reply

DSB - config collection - change line during collection

Authority
Posts: 5
1621     0

Hi,

 

One of our devices changes the encrypted password during config collection.

As such each collection is seen as being a new configuration to be archived.

 

I know how to complete filter those lines out with a noise filter in a custom DSB.

 

But how does the 'replace' operation work?

 

Let's take this example :

config tacacs password 1 abcdef123456 16 123456abcdef

 

I want the config collection to replace everything behind 'password 1' into 'encrypted_password'.

 

how can I do this with a custom dsb?

 

This doesn't work :-(

<processconfig vendor="Cisco" priority="101" operation="replace" line_match="\\s*config\\s+tacacs\\s+password\\s+1\\s+(\\S+\\s+\\S+\\s+\\S+)" var_match="$1" replace_val="encrypted_password" enabled="true" config_type="saved" />

 

But I can't find an example on how the replace operation works.

 

 

 

Showing results for 
Search instead for 
Did you mean: 

Recommended for You