Convert Enum (Application Protocol) to String

Hey ​@olivier_m ,

the short of the issue here is that enumerated fields cannot be converted to string. Enumerated fields are UDM objects that have a numerical value and a display value. If the UDM field network.application_protocol has the “value” of HTTPS, the value is actually 2001. SecOps handles the string representation of the enum field for easy searching and rules development (when correlating, not in conversion). 

To get around this, you would have to interpret the field with an If statement, similar to below:
$temp_protocol = if($e.network.application_protocol = “HTTPS”,”https”,”http”)

Then you could use the placeholder variable in your concatenation function.

Thanks for your answer.
 

Not the prettiest solution but I’m taking it 😁

i think you posted twice this post haha, and inline with cyberdarren my answer to the duplicated post was practically the same: 

Hey man ! i hope you want to do this on the outcome section as this will not work on the events sections: 

Short answer: network.application_protocol is an enum (backstory.Network.ApplicationProtocol), and strings.concat only accepts string / int / float, so you can't pass the raw enum into it.

There's also no native cast for it — cast.as_string only handles INT, BYTES, and BOOL, not enums. So your instinct is right, you just need a different mechanism to get a string out of the enum.

The trick: enums can be compared against their string labels, so you use if() in the outcome section to emit a plain string, then concat that.

Single-event rule:
yaral
outcome:
  // get the enum values as strings on anothe variable
  $protocol_str = if($e.network.application_protocol = "HTTPS", "https",
                  if($e.network.application_protocol = "HTTP",  "http", "http"))

  // now concat receives pure strings and compiles fine
  $url = strings.concat($protocol_str, "://", $e.target.url)

Multi-event rule (non-constant outcome vars need an aggregation function):
yaral
outcome:
  $url = array_distinct(strings.concat(
           if($e.network.application_protocol = "HTTPS", "https",
           if($e.network.application_protocol = "HTTP",  "http", "http")),
           "://",
           $e.target.url))

hope this helps you

https://medium.com/@gromerosec