Hello everyone,
Due to the parsing of proxy logs, I need to “re-build” the URL from network.application_protocol and target.url: $url = strings.concat($e.network.application_protocol, "://", $e.target.url)
I’m getting the following error:
compilation error compiling query: validating query: expect type [string int float], got type backstory.Network.ApplicationProtocol for "e.udm.network.application_protocol"
I guess I need to convert the enum to string.
Any solutions for that ?
Thanks,
Question
Convert Enum (Application Protocol) to String
+3Hey
the short of the issue here is that enumerated fields cannot be converted to string. Enumerated fields are UDM objects that have a numerical value and a display value. If the UDM field network.application_protocol has the “value” of HTTPS, the value is actually 2001. SecOps handles the string representation of the enum field for easy searching and rules development (when correlating, not in conversion).
To get around this, you would have to interpret the field with an If statement, similar to below:$temp_protocol = if($e.network.application_protocol = “HTTPS”,”https”,”http”)
Then you could use the placeholder variable in your concatenation function.
Thanks for your answer.
Not the prettiest solution but I’m taking it 😁
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.