cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

Removing text from header first line

Jump to solution
Hello. I have a question about configuring log lines in MWG I`m using "Request.Header.Firstline" to put URLs matched my rule in log file. I want somehow cut text past "?" symbol, so in logfile it would be for example only "https://website/token" instead of some huge line with unneeded information in it
1 Solution

Accepted Solutions
McAfee Employee mkutrieba
McAfee Employee
Report Inappropriate Content
Message 2 of 4

Re: Removing text from header first line

Jump to solution

Hi,

 

at first, I do not recommend this and would keep the property as it is but if you really want/need to change this, then you need to replace this property Request.Header.FirstLine with other properties (strings) which you "concat" together.
Problem is, that first line contains the command name, request line and protocol which you manually would need to merge.

 

For example:
URL.Host is only the host www.google.com
URL.Path is only the path /search
URL.ParametersString is the complete parameter string beginning with character "?"
URL.Protocol is only the protocol like HTTP or HTTPS
Command.Name is the name of the HTTP or FTP command like "CONNECT" or "GET" etc.

Here a screenshot showing above examples:

 

URL properties.JPG

 

So if you want to do this, you would need to use property "String.Concat()" and then merge the command name with URL protocol, host and path and then the protocol again to get a similar output to original (just without parameters):
"GET https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=g&oit=1&cp=... HTTP/2.0"

 

But as you can see, this will not be 100% the same as the property Request.Header.FirstLine output because it shows "HTTP/2.0" at the end and modified way would show "http" or "https".

 

Regards,
Marcel

Regards,
Marcel Kutrieba
Technical Support Engineer

View solution in original post

3 Replies
McAfee Employee mkutrieba
McAfee Employee
Report Inappropriate Content
Message 2 of 4

Re: Removing text from header first line

Jump to solution

Hi,

 

at first, I do not recommend this and would keep the property as it is but if you really want/need to change this, then you need to replace this property Request.Header.FirstLine with other properties (strings) which you "concat" together.
Problem is, that first line contains the command name, request line and protocol which you manually would need to merge.

 

For example:
URL.Host is only the host www.google.com
URL.Path is only the path /search
URL.ParametersString is the complete parameter string beginning with character "?"
URL.Protocol is only the protocol like HTTP or HTTPS
Command.Name is the name of the HTTP or FTP command like "CONNECT" or "GET" etc.

Here a screenshot showing above examples:

 

URL properties.JPG

 

So if you want to do this, you would need to use property "String.Concat()" and then merge the command name with URL protocol, host and path and then the protocol again to get a similar output to original (just without parameters):
"GET https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=g&oit=1&cp=... HTTP/2.0"

 

But as you can see, this will not be 100% the same as the property Request.Header.FirstLine output because it shows "HTTP/2.0" at the end and modified way would show "http" or "https".

 

Regards,
Marcel

Regards,
Marcel Kutrieba
Technical Support Engineer

View solution in original post

Re: Removing text from header first line

Jump to solution

Thanks. I made it look like like this and thi is exactly what i needed.

  • String.Concat (String.Concat (URL.Protocol, "://"), String.Concat (URL.Host, URL.Path))

Re: Removing text from header first line

Jump to solution

maybe you could also do: String.ReplaceAll(URL,URL.ParameterString,""), like just delete out the parameters

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community