5 Replies Latest reply on Feb 12, 2016 3:51 AM by Niranjay Bharati

How to loop through all values returned by Extended Object without declaring them explicitly in loop body

Argyris Spinos Jan 29, 2016 5:58 AM

Hello,

I have created below compliance rule to check that only IP’s from specific networks listen on SMTP port 25:

"RPM:sendmail" exists

then

foreach "Extended Object Entry:Get SMTP listening interfaces - csv//**"

( @"Value1 as String (All OS)"@ = "127.0.0.1" OR

@"Value1 as String (All OS)"@ starts with "192.168.2."

) AND

( @"Value2 as String (All OS)"@ = "127.0.0.1" OR

@"Value2 as String (All OS)"@ starts with "192.168.2."

) AND

( @"Value3 as String (All OS)"@ = "127.0.0.1" OR

@"Value3 as String (All OS)"@ = "??TARGET.IP_ADDRESS??"

)

end

My EO is a command that returns all IP’s listening on port 25 in csv format. Can I make above script non-depended on how many values the EO will return. In other words make it like so:

"RPM:sendmail" exists

then

foreach "Extended Object Entry:Get SMTP listening interfaces - csv//**"

( @"Value* as String (All OS)"@ = "127.0.0.1" OR

@"Value* as String (All OS)"@ starts with "192.168.2."

)

end

Thanks

1. Re: How to loop through all values returned by Extended Object without declaring them explicitly in loop body

Bill Robinson Feb 4, 2016 9:25 AM (in response to Argyris Spinos)

you can change the rule to be like eo entry//** matches and use regex.

can you do some sorting in the eo script itself so you don't need to have every possible value position check in the rule ?
Like Show 0 Likes(0)

Actions
2. Re: How to loop through all values returned by Extended Object without declaring them explicitly in loop body

Argyris Spinos Feb 11, 2016 6:10 AM (in response to Bill Robinson)

Bill,

Let me see if I got this right:

if I do eo entry//** matches wouldn't I still have to enumerate every value like:

foreach "Extended Object Entry:Get SMTP listening interfaces - csv//**"
             @"Value1 as String (All OS)"@ matches "192.168.2.| ..."
      ) AND
             @"Value2 as String (All OS)"@ matches "192.168.2.| ..."
and so on?

Would it be a solution to assign the eo command in the rule and apply the matches clause on it, like:

??SMTP_INT?? assign Command:"command in EO"
??SMTP_INT?? matches "regex | regex"

?

Thanks
Like Show 0 Likes(0)

Actions
3. Re: How to loop through all values returned by Extended Object without declaring them explicitly in loop body

Niranjay Bharati Feb 11, 2016 7:07 AM (in response to Argyris Spinos)

You should try producing output of the EO in the XML tags such that it should be a separate line enclosed within an XML tag. you can try using other grammar files to parse the output.
for example, <finding>127.0.0.1 192.168.x.x</finding>
<finding>127.0.0.1 192.168.x.x</finding>
<finding>127.0.0.1 192.168.x.x</finding>

If you are not going to use EO then you can use command output and matches operator to match it to regex.
Like Show 0 Likes(0)

Actions
4. Re: How to loop through all values returned by Extended Object without declaring them explicitly in loop body

Argyris Spinos Feb 11, 2016 9:36 AM (in response to Niranjay Bharati)

Hello Niranjay,

I tried below, but since my commands prints more than one value in the console, the matches operator fails. In the results it's looking for "Left value": IP1IP2 (bundled together the two IP's). Any way I can work around this?

foreach "Command:netstat -an | awk '/:25/{ print $4 }' | sed 's/:25.*//'"
@Out_Put@ matches "192\.168\.2\.\d{1,3}"

Thanks
Like Show 0 Likes(0)

Actions
5. Re: How to loop through all values returned by Extended Object without declaring them explicitly in loop body

Niranjay Bharati Feb 12, 2016 3:51 AM (in response to Argyris Spinos)

Hi, The command output is not getting separated per line so in this case you have to use EO with appropriate grammar file e.g. "whole line as a record" that will go through individual output lines. your EO rule should be something like

foreach "Extended Object Entry:netstat command//**"
@Name@ matches "192\.168\.2\.\d{1,3}"
end
Like Show 0 Likes(0)

Actions

Go to original post

Communities

Communities

How to loop through all values returned by Extended Object without declaring them explicitly in loop body

1. Re: How to loop through all values returned by Extended Object without declaring them explicitly in loop body

2. Re: How to loop through all values returned by Extended Object without declaring them explicitly in loop body

3. Re: How to loop through all values returned by Extended Object without declaring them explicitly in loop body

4. Re: How to loop through all values returned by Extended Object without declaring them explicitly in loop body

5. Re: How to loop through all values returned by Extended Object without declaring them explicitly in loop body

Actions

More Like This