Compare relevance output to .csv file that has port ranges

Content Authoring
1

The below relevance works correctly. This result output is all non-matching elements compared to a .csv file. (example of the file below and is attached, rename file to .csv.) If there is not a match, then results are output

BESConsole.exe:53004:TCP
BESConsole.exe:53242:TCP
firefox.exe:50731:TCP
firefox.exe:65170:TCP
firefox.exe:65169:TCP
chrome.exe:55922:TCP
BESRootServer.exe:52311:TCP
BESRootServer.exe:57485:UDP
BESWebReportsServer.exe:55180:TCP
BESWebReportsServer.exe:80:TCP
dfsrs.exe:49207:TCP
dfsrs.exe:49210:TCP
dfsrs.exe:52542:TCP
dfsrs.exe:53692:UDP
dfsrs.exe:56305:TCP

concatenation “;” of elements of (set of ((if (it does not start with “-”) then it else nothing) of ((item 4 of it & “:” & following text of last “:” of item 1 of it & “:” & item 0 of it) of ( (if (tcp of it) then (“TCP”) else (“UDP”)), local address of it as string & “:” & local port of it as string, (if (exists remote address of it) then (remote address of it as string & “:” & remote port of it as string) else (“:”)), (if (exists tcp state of it) then (tcp state of it as string) else (“-”)), (if (exists process of it and exists name of process of it) then (name of process of it) else (“-”)) ) of sockets of network)) - set of (it as string) of lines of file (parent folder of client as string & “\Baselines\services.csv”))

Problem statement: What I would like to be able to do is to use ranges in the .csv file for the ports and not list them out. This would provide simple maintenance of the file which has to be maintained. any thoughts of how to do that?

example
services.pdf (1.5 KB)
dns.exe:50000-60000:UDP

2

The services.pdf needs to be renamed to services.csv.

3

I won’t rewrite the whole relevance but you might be able to use a substitution like

Here, 123 and 900 would be the ports found on the machine, where the “123-125”;“456”;“789” would be the set of ports listed in the CSV.

q: (123;900) whose (not exists (it, ("123-125";"456";"789") ) whose (if item 1 of it contains "-" then item 0 of it >= preceding text of first "-" of item 1 of it as integer and item 0 of it <= following text of first "-" of item 1 of it as integer else item 0 of it = item 1 of it as integer))

A: 900
T: 0.085 ms
I: plural integer

The logic can get a bit simpler if you determine that every port reference in the CSV file should have the hyphen, even for only a single port (such as BESRootServer.exe:52311-52311:TCP).

4

Thanks Jason for taking time to provide that information. I will need some time to digest this and see how I could work that into my existing relevance as I may need to ask more questions. Thanks again.