diff --git a/.gitignore b/.gitignore
index 1b2211df..0ec9e7f9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-build*
+/build*
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 4cf2f781..dada17b0 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -40,6 +40,16 @@ set(LUAJIT_INCLUDE_DIR "${sysdig_BINARY_DIR}/luajit-prefix/src/luajit/src")
 message(STATUS "Using bundled curl in '${CURL_BUNDLE_DIR}'")
 message(STATUS "Using SSL for curl in '${CURL_SSL_OPTION}'")
 
+include(ExternalProject)
+
+ExternalProject_Add(lpeg
+		    URL "https://s3.amazonaws.com/download.draios.com/dependencies/lpeg-1.0.0.tar.gz"
+                    URL_MD5 "0aec64ccd13996202ad0c099e2877ece"
+                    BUILD_COMMAND LUA_INCLUDE=/sysdig/digwatch/build-ubuntu/sysdig/luajit-prefix/src/luajit/src ${PROJECT_SOURCE_DIR}/scripts/build-lpeg.sh
+                    BUILD_IN_SOURCE 1
+		    CONFIGURE_COMMAND ""
+                    INSTALL_COMMAND cp lpeg.so re.lua ${PROJECT_SOURCE_DIR}/userspace/digwatch/lua)
+
 
 
 add_subdirectory(userspace/digwatch)
diff --git a/scripts/build-lpeg.sh b/scripts/build-lpeg.sh
new file mode 100755
index 00000000..bc04c41a
--- /dev/null
+++ b/scripts/build-lpeg.sh
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+gcc -O2 -fPIC -I$LUA_INCLUDE -c lpcap.c -o lpcap.o
+gcc -O2 -fPIC -I$LUA_INCLUDE -c lpcode.c -o lpcode.o
+gcc -O2 -fPIC -I$LUA_INCLUDE -c lpprint.c -o lpprint.o
+gcc -O2 -fPIC -I$LUA_INCLUDE -c lptree.c -o lptree.o
+gcc -O2 -fPIC -I$LUA_INCLUDE -c lpvm.c -o lpvm.o
+gcc -shared -o lpeg.so -L/usr/local/lib lpcap.o lpcode.o lpprint.o lptree.o lpvm.o
+