mirror of
https://github.com/rwinkhart/go-highlite.git
synced 2026-08-28 04:46:30 -04:00
31 lines
1.0 KiB
YAML
31 lines
1.0 KiB
YAML
filetype: netstat
|
|
|
|
detect:
|
|
filename: "\\.netstat$"
|
|
header: "(^Active Internet connections|\\sRecv-Q\\sSend-Q\\sLocal Address)"
|
|
|
|
rules:
|
|
# Scan Title
|
|
- magenta: "\\sRecv-Q\\sSend-Q\\sLocal Address.*"
|
|
# IP
|
|
- yellow: "\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}"
|
|
# Ports
|
|
- green: "^(\\d+)"
|
|
- red: "(\\s+\\d+)/(\\w+).*"
|
|
- red: "users:\\(\\(\"[a-zA-Z.0-9-]+\",pid=\\d+,fd=\\d+\\).*"
|
|
- magenta: "\\s+([a-zA-Z-]+)$"
|
|
# Ports Details
|
|
- yellow: "^\\|_?(.*)"
|
|
- yellow: "(Service Info|OS details|Device type|Running):\\s.*$"
|
|
- constant.number: "(\\b[0-9.]+\\b|\\b0x[0-9A-Fa-f]+\\b)([ms|s|seconds])?(\\s+|$)"
|
|
- yellow: "\\d{4}-\\d{2}-\\d{2}\\s\\d{2}:\\d{2}(:\\d{2})?"
|
|
- yellow: "\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}"
|
|
# hostname
|
|
- yellow: "\\s+([a-z-]+\\.)?[a-z-]+\\.[a-z-]+\\.[a-z-]+"
|
|
- green: "(tcp)(6)?"
|
|
- yellow: "(unix|udp(6)?)"
|
|
- green: "(CONNECTED|ESTABLISHED|LISTEN)"
|
|
- red: "\\s+SYN_SENT"
|
|
- yellow: "pid=\\d+"
|
|
- green: "\"[a-zA-Z.0-9-]+\""
|