FIX CEF PARSER

[EmileDqy]

Currently, the CEF parser fails for two reasons:

• When it encounters an escaped slash ( \/ ) in the middle of a value
• When the last value is empty

This is particularly problematic for us as we have a lot of data in this format to parse.

Behavior:

• Log

  CEF:0|nxlog.org|nxlog|2.7.1243|Executable Code was Detected|Advanced exploit detected|100|path=Some\/Path spt=46117 dst=172.25.212.204 dpt=

• Rulebase

  version=2
  rule=%.:cef%

• Expected behavior

  {
  "DeviceVendor": "nxlog.org",
  "DeviceProduct": "nxlog",
  "DeviceVersion": "2.7.1243",
  "SignatureID": "Executable Code was Detected",
  "Name": "Advanced exploit detected",
  "Severity": "100",
  "Extensions": {
  "path": "Some/Path",
  "spt": "46117",
  "dst": "172.25.212.204",
  "dpt": ""
  }
  }

• Current behavior

  {
  "originalmsg": "CEF:0|nxlog.org|nxlog|2.7.1243|Executable Code was Detected|Advanced exploit detected|100|path=Some\\/Path spt=46117 dst=172.25.212.204 dpt=",
  "unparsed-data": "CEF:0|nxlog.org|nxlog|2.7.1243|Executable Code was Detected|Advanced exploit detected|100|path=Some\\/Path spt=46117 dst=172.25.212.204 dpt="
  }

Tests

With this fix, the CEF parser is now more flexible than before when it comes to the trailing spaces after the headers (it ignores them). I had to change the tests that were dealing with this behavior.