ossec-regex-convert¶
ossec-regex-convert converts OSSEC legacy regex XML tags to PCRE2 equivalents in
decoder and rule files. Use it when migrating custom decoders from pre-PCRE2 formats.
Synopsis¶
ossec-regex-convert [-b] [-r|-m] [-t] [pattern]
Options¶
- -h, --help¶
Display help and exit.
- -b, --batch¶
Batch mode: read patterns from stdin, one per line.
- -r, --regex¶
Convert
regex/prematchstyle patterns (default).
- -m, --match¶
Convert
matchstyle patterns.
- -t, --tags¶
List supported XML tag mappings and exit.
Tag mappings¶
Common conversions include regex → pcre2, match → match_pcre2,
program_name → program_name_pcre2, prematch → prematch_pcre2, and
similar mappings for GeoIP, port, user, url, and status fields.
Examples¶
Convert a single pattern:
ossec-regex-convert "failed password for"
List all supported tag names:
ossec-regex-convert -t