Variables

Variables - Allow you to supply values to events when they are generated.

If a non-existent variable is used, its value will be replaced with **ERROR**

Variable work over time

Set the current time

{{date1}} Set current time Format: mmm d hh:nn:ss (SD-syslog RFC 3164)
Example: Feb 8 15:28:40
{{date2}} Set current time Format: mmm d hh:nn:ss.zzz
{{date3}} Set current time Format: dd-mm-yy
{{date4}} Set current time Format: hh:nn:ss
{{date7}} Set current time Format: yyyy-mm-dd
{{date8}} Set current time Format: mmm dd yyyyy hh:nn:ss.zzz
{{date10}} Set current time Format: mmm dd yyyyy hh:nn:ss
Example: Sep 12 2017 12:36:22 PM.
{{date12}} Sets the current time, indicating the current time zone Format: yyyy-mm-ddThh:nn:ss.zzzzzz+tz:00
Example: 2022-01-18T14:46:38.682597+03:00
{{date13}} Set current time Format: yyyy-mm-ddThh:nn:ss.zzzzzzzzzZ
Example: 2022-01-14T15:10:39.368259701Z
{{date14}} Set current time Format: dd/mmm/yyyyy:hh:nn:ss
Example: 12/Aug/2022:14:54:34.
{{date15}} Set current time Format: yyyy-mm-ddThh:nn:ss.zzzzzzzz
Example: 2020-10-04T16:12:36.208147
{{date17}} Set current time Format: mmm dd hh:nn:ss
Example: Feb 08 12:30:14
{{date18}} Set current time Format: yyyyy-mm-dd hh:nn:ss
Example: 2022-07-08 09:00:58
{{date20}} Set current time Format: yyyy-mm-ddThh:nn:ss.zzzzzz+tz00
Example: 2022-01-18T14:46:38.682597+0300
{{date21}} Set current time Format: yyyy-mm-ddThh:nn:ss+tz:00
Example: 2022-01-18T14:46:38+03:00
{{date23}} Set current time Format: yyyy-mm-ddThh:nnZ
Example: 2024-04-22T13:50:15Z
{{h}} Returns the current hour Example: 1, 7, 11
{{hh}} Returns the current hour, in two-character format Example: 01, 07, 11
{{n}} Returns the current minute Example: 1, 7, 11
{{nn}} Returns the current minute, in two-character format Example: 01, 07, 11
{{s}} Returns the current second Example: 1, 7, 11
{{ss}} Returns the current second, in two-character format Example: 01, 07, 11
{{zzz}} Returns the current milliseconds, in three-character format Example: 675, 375, 999
{{zzzzzz}} Returns the current milliseconds, in five-character format Example: 675001
{{zzzzzzzzz}} Returns the current milliseconds, in nine-character format Example: 675001589
{{yy}} Returns the current year, in two-character format Example: 21, 22
{{yyyy}} Returns the current year, in four-character format Example: 2021, 2022
{{m}} Returns the current month number Example: 1, 2, 3 ... 12
{{mm}} Returns the current month number, in two-character format Example: 01, 02, 03 ... 12
{{mmm}} Returns the name of the current month in abbreviated format Example: Jan, Feb, Mar ... Dec
{{d}} Returns the current day of the month Example: 1, 2, 3
{{dd}} Returns the current day of the month, in two-character format Example: 01, 02, 03
{{MONTH}} Returns the full name of the month Example: October
{{wday}} Returns the current day of the week Example: Sun, Thu, Fri

Set the current time in UTC

{{TimeStamp}} Returns the current time in Unix TimeStamp format Example: 1643791184
{{TimeStampMili}} Returns the current time in Unix TimeStamp format Пример: 1643791184000
{{TimeStampNano}} Returns the current time in Unix TimeStamp format Пример: 1643791184000000
{{strict_date_optional_time}} Sets the current time in UTC Format yyyy-MM-dd'T'HH:mm:ss.SSSZ
Example: 2024-05-15T12:41:36.821Z
{{date5}} Sets the current time in UTC Format: mmm dd hh:nn:ss
Example: Feb 08 12:30:14
{{date6}} Sets the current time in UTC Format: dd/mmm/yyyyy:hh:nn:ss
Пример: 12/Aug/2022:11:48:36
{{date9}} Sets the current time in UTC Format: yyyy-mm-ddThh:nn:ss.zzzzzzzz+0000
Example: 2020-10-04T16:12:36.208147+0000
{{date11}} Sets the current time in UTC Format: yyyy-mm-ddThh:nn:ss+00:00
Example: 2021-10-18T06:46:04+00:00
{{date16}} Sets the current time in UTC Format: yyyy-mm-ddThh:nnZ
Example: 2022-07-08T09:00Z
{{date19}} Sets the current time in UTC Format: yyyyy-mm-dd hh:nn:ss.zzz
{{date22}} Sets the current time in UTC Format: yyyy-mm-ddThh:nn:ss+00:00
Example: 2022-01-18T14:46:38+00:00
{{date24}} Sets the current time in UTC Format: yyyy-mm-ddThh:nn:ss.zzzzzzzz+00:00
Example: 2020-10-04T16:12:36.208147+00:00
{{utc_h}} Returns the current hour in UTC Example: 1, 7, 11
{{utc_hh}} Returns the current hour in UTC, in two-character format Example: 01, 07, 11
{{utc_n}} Returns the current minute in UTC Example: 1, 7, 11
{{utc_nn}} Returns the current minute in UTC, in two-character format Example: 01, 07, 11
{{utc_s}} Returns the current second in UTC Example: 1, 7, 11
{{utc_ss}} Returns the current second in UTC, in two-character format Example: 01, 07, 11
{{utc_zzz}} Returns the current milliseconds in UTC, in three-character format Example: 675, 375, 999
{{utc_zzzzzz}} Returns the current milliseconds in UTC, in five-character format Example: 675001
{{utc_zzzzzzzzz}} Returns the current milliseconds in UTC, in nine-character format Example: 675001589
{{utc_yy}} Returns the current year in UTC, in two-character format Example: 21, 22
{{utc_yyyy}} Returns the current year in UTC, in four-character format Example: 2021, 2022
{{utc_m}} Returns the current month number in UTC Example: 1, 2, 3 ... 12
{{utc_mm}} Returns the current month number in UTC, in two-character format Example: 01, 02, 03 ... 12
{{utc_mmm}} Returns the name of the current month in UTC in abbreviated format Example: Jan, Feb, Mar ... Dec
{{utc_d}} Returns the current day of the month in UTC Example: 1, 2, 3
{{utc_dd}} Returns the current day of the month in UTC, in two-character format Example: 01, 02, 03

Set the time the next day

{{INCdate5}} Sets the time in UTC format by adding one day without changing the time Format: mmm dd hh:nn:ss
Example: Feb 08 12:30:14
{{INCdate6}} Sets the time in UTC format by adding one day without changing the time Format: dd/mmm/yyyyy:hh:nn:ss
Пример: Feb 10 09:20:13
{{INCdate8}} Sets the time in UTC format by adding one day without changing the time Format: mmm dd yyyyy hh:nn:ss.zzz
{{INCdate9}} Sets the time in UTC format by adding one day without changing the time Format: yyyy-mm-ddThh:nn:ss.zzzzzzzz+0000
Example: 2020-10-04T16:12:36.208147+0000
{{INCdate11}} Sets the time in UTC format by adding one day without changing the time Format: yyyy-mm-ddThh:nn:ss+00:00
Example: 2021-10-18T06:46:04+00:00

Sets the time last day

{{DECdate1}} Sets the time in the current time zone, last day, without changing the time Формат: mmm d hh:nn:ss
Example: Feb 8 15:28:40
{{DECdate5}} Sets the time in UTC format, last day , without changing the time Format: mmm dd hh:nn:ss
Example: Feb 08 12:30:14
{{DECdate6}} Sets the time in UTC format, last day, without changing the time Format: dd/mmm/yyyyy:hh:nn:ss
Пример: Feb 10 09:20:13
{{DECdate8}} Sets the time in UTC format, last day, without changing the time Format: mmm dd yyyyy hh:nn:ss.zzz
{{DECdate9}} Sets the time in UTC format, last day, without changing the time Format: yyyy-mm-ddThh:nn:ss.zzzzzzzz+0000
Example: 2020-10-04T16:12:36.208147+0000
{{DECdate11}} Sets the time in UTC format, last day, without changing the time Format: yyyy-mm-ddThh:nn:ss+00:00
Example: 2021-10-18T06:46:04+00:00

Set random times

{{RNDdate1}} Sets time in UTC format, returns a date from the past within 30 days of the current date, changes the hour, minutes and seconds remain current Format: mmm d hh:nn:ss (SD-syslog RFC 3164)
Example: Feb 8 15:28:40
{{RNDdate5}} Sets time in UTC format, returns a date from the past within 30 days of the current date, changes the hour, minutes and seconds remain current Format: mmm dd hh:nn:ss
Example: Feb 08 12:30:14
{{RNDdate6}} Sets time in UTC format, returns a date from the past within 30 days of the current date, changes the hour, minutes and seconds remain current Format: dd/mmm/yyyyy:hh:nn:ss
Пример: Feb 10 09:20:13
{{RNDdate8}} Sets time in UTC format, returns a date from the past within 30 days of the current date, changes the hour, minutes and seconds remain current Format: mmm dd yyyyy hh:nn:ss.zzz
{{RNDdate9}} Sets time in UTC format, returns a date from the past within 30 days of the current date, changes the hour, minutes and seconds remain current Format: yyyy-mm-ddThh:nn:ss.zzzzzzzz+0000
Example: 2020-10-04T16:12:36.208147+0000
{{RNDdate11}} Sets time in UTC format, returns a date from the past within 30 days of the current date, changes the hour, minutes and seconds remain current Format: yyyy-mm-ddThh:nn:ss+00:00
Example: 2021-10-18T06:46:04+00:00

Constants

A set of constants that do not change their value, they are necessary for correct conversion of events into templates.

Constant Value Description
{{broadcast_mac}} ff:ff:ff:ff:ff:ff
{{INADDR_ANY}} 0.0.0.0
{{broadcast}} 255.255.255.255
{{localhost}} 127.0.0.1
{{null_mac}} 00:00:00:00:00:00
{{multicast}} 224.0.0.251
{{lbrace}} { Left curly bracket
{{rbrace}} } Right curly bracket
{{amp}} & Tilda
{{quot}} " double quotation mark
{{lt}} < Less
{{gt}} > More
{{apos}} ' Single quote
{{lsqb}} [ Left square bracket
{{rsqb}} ] Right square bracket
{{vert}} | () Vertical line
{{bsol}} \ Slash
{{percnt}} % Percent
{{num}} # Grid
{{quest}} ? Question
{{tilde}} ~ Tilda
{{RLO}} UTF-8 sequence to switch text direction from right to left (RLO)
{{Lorem_Ipsum}} Lorem Ipsum is a fish text often used in print and web design. Lorem Ipsum has been the standard “fish” for Latin texts since the early 16th century.
{{test_message}} <14>Test syslog message

Static variables

Sets a value that does not change during operation. This type of variables is intended primarily for playbooks, since the main functionality of sending events is multithreaded and each thread will have its own value.

Variable Description Example
{{sIp}} Sets a random IP address Subnet 0.0.0.0.0/0.
{{sIp_10}} Sets a random IP address from subnet 10.0.0.0.0/8
{{sMac}} Sets a random MAC address
{{sIPv6}} Sets a random IPv6 address
{{sIface}} Sets a random interface name
{{sLocalIP}} Sets a random IP address on the local network Subnet: 192.168.0.0/24
{{sdeviceExternalId}} Sets a random ID Range 1000000000 to 1516122234
{{sUser}} Sets a random user name
{{sR10}} Sets a random number from 1 to 10
{{suser_sid}} Sets a random user SID Example: S-1-5-21-1138026051-802832935-419703519-2104
{{sserver_hostname}} Sets a random name in server format Examples:
app-alkaphrah-prd
mon-wezen-dev
{{sessionid}} Случайное число длиною 10 знаков Пример: 1885704636
{{session_id}} Случайное шестнадцатеричное число длиною 10 знаков Пример: 0033888c75

Lists

Variables to get a random value from a text file

Some of the lists are already filled with values, which can be changed if necessary

Variable Assignment File path
{{ip_list}} List of IP addresses data/iplist.txt
{{domain_list}} List of domains data/domainlist.txt
{{fqdn_list}} List of FQDNs data/fqdn_list.txt
{{hostname_list}} Host list data/hostname_list.txt
{{useragent_list}} List of user agents (user-agent) data/user-agent.txt
{{from_list}} data/From.txt
{{recipient_list}} data/Recipient.txt
{{malware_ip}} List of malicious IP addresses data/malware_ip.txt
{{patronymic}} A man's patronymic in Russian data\patronymic.txt
{{masculine_name}} A man's name in Russian data\masculine_name.txt
{{male_surname}} Male surname in Russian data\male_surname.txt
{{linux_cmd}} Random Linux command data\linux_cmd.txt
{{cisco_cmd}} Random Cisco command data\cisco_cmd.txt
{{Wfile_path}} Windows Random Path data\Wfile_path.txt
{{WDQfile_path}} Windows random path, with doubled slashes data\WDQfile_path.txt
{{file_path}} Linux Random Path data\file_path.txt
{{url_json}} Random URI in Json format (with escaping) data\url_json.txt
{{url}} Returns a random URI

Examples:
/fwlink/?LinkID=252669&clcid=0x409
/clck/counter
/canonical.html

data\url.txt
{{user_agent_json}} Random User-Agent in json format (escaped) data\user_agent_json.txt
{{user_agent}} Random User-Agent data\user_agent.txt
{{domain}} Random domain from the list

Examples:
1.test.3322.org.cn
hotmal1.com
go.microsoft.com

data\domain.txt
{{eventlog_category}} Returns a random category (IDS)

Examples:
SIP EVENT EMPTY REQUEST URI
AM SCAN RDP bruteforce attempt failed logons

data\eventlog_category.txt
{{dtz}} Random time zone

Examples:
Pacific/Auckland
Asia/Vladivostok

data\dtz.txt
{{CP_protection_name}} Returns the name of the CheckPoint signature

Examples:
ZMap Security Scanner over HTTP
PHP Proxy Server Scanning Attempt

data\CP_protection_name.txt

System information

{{observer}} Returns the name of the current computer/server
{{GetIP}} Returns the current IP of the computer/server Если используется несколько локальных IP, возвращает первый из списка.
{{TickCount}} Returns the number of milliseconds that have elapsed since the system was started

Пример: 1235869343

Dynamic variables

Variables that constantly change their value within the described rules.

{{mac1}}
{{mac2}}
Generates a random MAC address Example: 00:50:56:b5:9b:25
{{macdash}} Generates a random MAC address

Example: 00-50-56-B5-9B-25

{{IP}} Returns a random IPv4 or IPv6 address There is a 70% probability that it will always be IPv4
{{Ip1}}
{{Ip2}}
Random IPv4 IP address Subnet 0.0.0.0.0/0
{{ipv6}} Random IPv6 IP address
{{arpa}} Returns a random in-addr.arpa address
{{HOME_NET_192}} Random IPv4 IP address Subnet 192.168.0.0/16
{{HOME_NET_172}} Random IPv4 IP address subnet 172.16.0.0/12
{{HOME_NET_10}} Random IPv4 IP address подсеть 10.0.0.0/8
{{HOME_NET_10_1}} Random IPv4 IP address подсеть 10.0.0.0/8
{{HOME_NET_10_2}} Random IPv4 IP address подсеть 10.0.0.0/8
{{HOME_NET_192_168_0}} Random IPv4 IP address subnet 192.168.0.0/24
{{NET_104_17_244}} Random IPv4 IP address subnet 104.17.244.0/24
{{Networks184_84_59}} Random IPv4 IP address subnet 184.84.59.0/24
{{small_localnet}} Random IPv4 IP address subnet 172.16.0.0/24
{{port1}}
{{port2}}
Random port Range from 0 to 65535
{{port_low}} Random port in the lower range Range from 0 to 999
{{dynamic_port}} Returns a random value from the dynamic range of ports Range 49152 to 65535
{{proto}} Random protocol in upper case TCP or UPD
{{proto2}} Random protocol in lower case tcp or udp
{{severity}} Random number from 1 to 3
{{Syslog_Severity}} Returns a random value Example:
{{rule_group}} Returns a random group (IDS) List:
emerging-scan
emerging-policy
emerging-dns
emerging-dos
emerging-current_events
{{eventlog_class}} Returns a random class (IDS) Examples:
1:2013504:3
140:3:1
1:2001972:19
{{HTTP_PORTS}} Returns a random HTTP port Values: 80, 81, 82, 83, 84, 85, 86, 87, 88, 8080, 8081, 8082, 8085, 8088, 8090, 8118, 8123, 8180, 8181, 9000, 9002, 9060, 9080, 9090, 9091, 9111, 9290, 9443, 9447, 9710, 9780, 9999, 10000
{{http_ver}} HTTP version Probability:
80% - HTTP/1.1
20% - HTTP/2
{{deviceExternalId}} Random ID Range 1000000000 to 1516122234
{{id}} Event number in the generator
{{LongID}} Event number in the generator Возвращает текущий ID события, возвращая 10 и более символов, заполняя не достающее значения ведущими нулями.
Пример: 0000000001
{{OpenVas_UserAgent}} Random OpenVAS User-Agent List:
Mozilla/5.0 [en] (X11, U; OpenVAS-VT 8.0.9)r
Mozilla/5.0 [en] (X11, U; OpenVAS-VT 11.0.1)
Mozilla/5.0 [en] (X11, U; OpenVAS-VT 9.0.3)
Mozilla/5.0 [en] (X11, U; OpenVAS 7.0.10)
Mozilla/5.0 [en] (X11, U; OpenVAS 8.0.9)
Mozilla/5.0 [en] (X11, U; OpenVAS 7.0.10)
Mozilla/5.0 [en] (X11, U; OpenVAS 8.0.9)
Microsoft WinRM Client OpenVAS-VT
{{referer}} URI Referrer With a 94% probability of “-”
{{referer_empty}} URI Referrer With 94% probability it will return an empty string
{{http_code}} Random HTTP code. Probability:
89% - 200
3% - 404
2% - 403
1% - 500
1% - 301
1% - 505
1% - 504
1% - 503
1% - 502
{{http_method}} Randomized HTTP method. Probability:
80% - GET
10% - POST
6% - HEAD
2% - CONNECT
1% - OPTIONS
1% - DELETE
{{hostname}}
{{hostname1}}
{{hostname2}}
Random computer name Format: DESKTOP-[7 random characters]
{{lhostname}} Random computer name from a limited list Format: DESKTOP-AD[01-10]
Example:
DESKTOP-AD01
DESKTOP-AD02
...
DESKTOP-AD10
{{server_hostname}} Returns a random name in server format Examples:
app-alkaphrah-prd
mon-wezen-dev
{{lrhostname}} A random computer name from a restricted list, with random name case. Example:
deSktOP-AD02
dEskToP-aD08
dESkToP-ad03
DEsKtop-aD01
{{web_proto}} Random HTTP protocol (http/https) Probability:
80% - https
20% - http
{{user_domain}} Random domain from the list List:
contoso
ad
test
demo
{{user_name}}
{{user_name1}}
{{user_name2}}
Randomly generated user name Examples:
Thenus
Thignus
Alfhaeh
Boignar
Botan
Casin
{{user_sid}} Random user SID Example: S-1-5-21-1138026051-802832935-419703519-2104
{{file_name}} Random file name Returns a random filename with a filename between 3 and 8 random characters and one of the extensions from the list, example:
doc
exe
pdf
xls
{{size}} Random number Range from 0 to 100000
{{size_kb}} Random size Format two random through point
first number between 0 and 999
the second number from 0 to 99 Example: 833.61
{{fuzzing}} Random character set Returns from 1 to 10240 random characters
{{uuidv4}} Ункиальный UUID в формате UUIDv4 Пример: d38f422d-84ad-4a4f-a165-8845cee4e3dd
{{UUIDv7}} Ункиальный UUID в формате UUIDv7 Пример: 01962537-72c6-d0b0-8b23-23dd12f6e863
{{GUID}}
{{GUID1}}
{{GUID2}}
Unique GUID Format: {00000000-0000-0000-0000-000000000000}
LGuid Unique GUID in lower case Format: {00000000-0000-0000-0000-000000000000}
{{md5}} Random string in MD5 format
{{sha1}} Random string in SHA1 format
{{sha256}} Random string in SHA256 format
{{Umd5}} Random string in MD5 format, upper case
{{Usha1}} Random string in SHA1 format, upper case
{{Usha256}} Random string in SHA256 format, upper case
{{RSA_SHA256}} Forms a string similar to the RSA SHA256 SSH string Examples:
pOdCb8IxhPkbEPJmFf9UFthfGc8d9Ruv1dkJEsVhfMk
B61tJLO1PPQyEE4hoM81hfAEJdAtbJyJgkvu16QdyCj
UGPv5g86ShQExU51UyVUCiv8kgxsf5F5ygJkxckO9ku
{{emailAddress}} Random e-mail Example:
info@yandex.com
product@fastmail.org
support@mailc.net
{{iface}} Network interface name Example:
enp0s2
ens160
{{fingerprint}} Random certificate fingerprint Example:
d0:07:91:57:8b:c3:0c:e9:db:...
78:8d:58:e7:16:0e:04:10:21:...
{{ca_serial}} Random certificate serial number Example:
AC:9A:5E:73:D4:86:6C
0A:F0:BA:C2:80:D9:2B
{{tls_ver}} TLS version with a probability
11% - TLS 1.0
29% - TLS 1.1
60% - TLS 1.2
{{R254}} Random number in the range from 1 to 254
{{R10}} Random number between 1 and 10
{{schitalka}} Returns a random line from the Ten Little Negroes poem.
{{dga_domain}} Random domain, externally similar to DGA domain
{{RA_Port}} A random port from a list specific to the remote administration software List: 5938, 12975, 32976, 6568, 7070, 5650, 5651, 5500, 5800, 5900, 5901, 6129, 4899, 9182, 31337, 35384, 35484,5931
{{rn_str}} Random string from 0 to 20 characters long

Examples:
EtAWZ7V9r5V
CszXcMgwhNGzq3YfY
qamS2oq
sR2EiKCLH7tvHAT0KtDG

{{Skyrim}} Returns a random “phrase” from the game Skyrim in Russian language

Example:
Пусть дорога приведёт тебя в тёплые пески

{{BoolVal}} Returns a random boolean value

True or False

{{lBoolVal}} Returns a random boolean value in lower case

true or false

{{HEXChar}} Returns a random value in hex format

Example: 0xa

{{HEXStr}}
{{HEXStr1}}
{{HEXStr2}}
{{HEXStr3}}
Returns a random sequence of the hex string

Example: 0x607800ca, 0xb70ddd0e, 0xed37b768

{{bytes_in}} Returns an integer in the range from 2 to 24999

There's a 20% chance it will always be zero

{{bytes_out}} Returns a random number between 0 and 24999

With a 30% probability, it will always be 0

{{mime}} Returns a random mime type

With a 50% probability it will always be text/html

{{fp_SHA256}} Returns a fp SHA256 format string

With a probability of 2% it will return the sign ?

Example line:
6d:d0:1c:2d:ff:77:87:af:bf:90:91:2e:0b: 19:70:b0:2f:e5:1a:c5:d7:50: 14:3f:ca:2d:24:0f:1c:af:72:39

{{dns_reserved_words}} Returns a random reserved DNS name (forbidden to use)

Example:
- ANONYMOUS
- AUTHENTICATED USER
- PROXY

{{not_a_virus}} Generates a random virus name

Example:
not-a-virus:HEUR:AdWare.Scripy.Generic
not-a-virus:HEUR:AdWare.Script.Generic
not-a-virus:HEUR:AdWare.Win32.Generic

{{linux_prog}} Random Linux application name

Example:
audispd
systemd
sudo

{{R999}} Returns an integer in the range of 100 to 999

{{R9999}} Returns an integer in the range from 1000 to 9999

{{R99999}} Returns an integer in the range from 10000 to 99999

{{R999999}} Returns an integer in the range from 100000 to 999999

{{R9999999}} Returns an integer in the range from 1000000 to 999999999

{{R99999999}} Returns an integer in the range from 10000000 to 99999999

{{R999999999}} Returns an integer in the range from 100000000 to 999999999

{{LOGLEVEL}} Returns a random event criticality level

Example:
Alert
Trace
Info
Emergency

{{CVE}} Returns a string string in CVE-dddd-dddd format

Example:
CVE-2024-1275

Share to friends
en_USEnglish