Text Processors

The Message Interpreter allows you to apply additional text processors to individual data elements within the overall message format. Axon supports the following text processors:

Any Text
Bracketed Value
CEF (Common Event Format)
CVE (Common Vulnerabilities and Exposures ID)
Double Mac
DSV (Delimited Separated Value)
Duration
Email
Enum
File Path
Integer
IP
JSON
Kebab
Key Value
MAC
MD5
Quoted
SHA1
SHA256
SHA512
Timestamp
URL
UUID
WEL (Windows Event Log)
Windows DNS Name
XML

Text Processor Configurations

Some text processors require you to specify certain configuration values, like delimiter, encapsulator, and escape character.

The following sections provide guidance for the text processors that require specifications.

Bracketed Value

Bracketed Type	Format Example
SQUARE	[square]
CURLY	{curly}
PAREN	(parenthesis)
ANGLE	<angle>

DSV (Delimited Separated Value)

DSV Type	Format Example	Description
CUSTOM	User defined	User defines: Delimiter (Optional) Encapsulator (Optional) Escape Character
CSV_QUOTE	field1,field2,"field3"	Delimiter: comma Encapsulator: quote
CSV_TICK	field1,field2,'field3'	Delimiter: comma Encapsulator: quote
SEMICOLON_QUOTE	field1;field2;"field3"	Delimiter: semicolon Encapsulator: quote
SEMICOLON_TICK	field1;field2;'field3'	Delimiter: semicolon Encapsulator: tick
COLON_QUOTE	field1:field2:"field3"	Delimiter: colon Encapsulator: quote
COLON_TICK	field1:field2:'field3'	Delimiter: colon Encapsulator: tick
PIPE_QUOTE	field1\|field2\|"field3"	Delimiter: pipe Encapsulator: quote
PIPE_TICK	field1\|field2\|'field3'	Delimiter: pipe Encapsulator: tick

Duration

Duration Type	Format Example
CUSTOM	User defined
HMS	HH:MM:SS
DHMS	DD:HH:MM:SS

File Path

File Path Type	Format Example
UNIX	/usr/local/bin/java
WINDOWS	C:\Program Files\Executable\execute.exe

Key Value

Key Value Type

Format Example

Description

CUSTOM

User defined

Required	KV Pair Delimiter Permissive Mode
Optional	KV Delimiter Value Open Encapsulator Value Close Encapsulator Key Close Encapsulator Key Open Encapsulator Value Escape Character

CISCO

Cisco format

N/A

CHECKPOINT

Checkpoint format

N/A

KEY_EQ_VAL_COMMA

field1=value1,field2=value2

Delimiter: comma

KEY_EQ_VAL_SEMICOLON

field1=value1;field2=value2

Delimiter: semicolon

KEY_EQ_VAL_PIPE

field1=value1|field2=value2

Delimiter: pipe

KEY_EQ_VAL_SLASH

field1=value1\field2=value2

Delimiter: slash

KEY_EQ_VAL_SPACE

field1=value1 field2=value2

Delimiter: space

KEY_EQ_VAL_TAB

field1=value1<tab>field2=value2

Delimiter: tab

MAC

MAC Type	Format Example
COLON_PAIRS	a1:b2:c3:d4:e5:f6
DASH_PAIRS	a1-b2-c3-d3-e4-f5
SPACE_PAIRS	a1 b2 c3 d4 e5 f6
NO_DELIM	a1b2c3d4e5f6

Timestamp

Timestamp Type	Format Example
CUSTOM	User defined
ISO8601	2015-11-12T00:24:35.079785200Z
EPOCH_SECONDS	1645821859
EPOCH_MILLIS	1645821859000