07/16-09:23:39.153899 [**] [1:1000000:0] "SERVER-WEBAPP Apache Log4j arbitrary code execution attempt" [**] [Classification: Attempted User Privilege Gain] [Priority: 1] [AppID: HTTP] {TCP} 192.168.1.2:50284 -> 192.168.2.3:80

07/16-09:23:39.153899 [would_drop] [**] [1:1000000:0] "SERVER-WEBAPP Apache Log4j arbitrary code execution attempt" [**] [Classification: Attempted User Privilege Gain] [Priority: 1] {TCP} 192.168.1.2:50284 -> 192.168.2.3:80
06/25-00:23:53.106340 [**] [1:1000001:1] "LOCAL UDP test" [**] [Priority: 0] {UDP} 127.0.0.1:34392 -> 127.0.0.1:31337

{
  "contract": "parser-studio.recipe.v0.2",
  "schemaRevision": "0.2",
  "compilerMode": "REVIEW_ONLY",
  "projectId": "draft-snort_snort_3",
  "sourceFormat": "regex",
  "bodyFormat": "regex",
  "sample": {
    "sha256": "a3e78f6e4660338664eae29c4be53f5714eebfb2f0d38f84ba1aad0224226cc4",
    "events": 1
  },
  "stages": [
    {
      "op": "split_event",
      "boundary": "single-line"
    },
    {
      "op": "parse_regex",
      "pattern": "^(?<raw_event>.*?(?:\\[Classification: (?<classification>[^\\]]+)\\] )?\\[Priority: (?<priority>\\d+)\\](?: \\[AppID: (?<appid>[^\\]]+)\\])? \\{(?<protocol>\\w+)\\} (?<srcendpoint>[\\d.]+:\\d+) -> (?<dstendpoint>[\\d.]+:\\d+))$"
    },
    {
      "op": "map_field",
      "source": "raw_event",
      "target": "raw_event",
      "group": "vendor_fields",
      "data_type": "string"
    },
    {
      "op": "map_field",
      "source": "classification",
      "target": "classification",
      "group": "vendor_fields",
      "data_type": "string"
    },
    {
      "op": "map_field",
      "source": "priority",
      "target": "priority",
      "group": "vendor_fields",
      "data_type": "string"
    },
    {
      "op": "map_field",
      "source": "appid",
      "target": "appid",
      "group": "vendor_fields",
      "data_type": "string"
    },
    {
      "op": "map_field",
      "source": "protocol",
      "target": "protocol",
      "group": "vendor_fields",
      "data_type": "string"
    },
    {
      "op": "map_field",
      "source": "srcendpoint",
      "target": "srcendpoint",
      "group": "vendor_fields",
      "data_type": "string"
    },
    {
      "op": "map_field",
      "source": "dstendpoint",
      "target": "dstendpoint",
      "group": "vendor_fields",
      "data_type": "string"
    },
    {
      "op": "classify",
      "defaultIndex": "syslog",
      "rules": []
    },
    {
      "op": "fallback_unparsed",
      "mode": "retain_unparsed"
    }
  ],
  "nativeVerified": false,
  "targetVerified": false
}