Skip to main content
Solved

Create a New Field by Summing Two Fields in Google SecOps

  • February 14, 2025
  • 1 reply
  • 52 views
prashant_nakum
Forum|alt.badge.img+4

Hi there,

I am trying to create a new field by summing two existing fields in Google SecOps SIEM but encountering an error. For example, I have the fields source_bytes and response_bytes, and I want to create a new field total_bytes, calculated as:  total_bytes = source_bytes + response_bytes

I wrote the query as follows:

metadata.event_type="xyz"
$total_bytes = $source_bytes + $response_bytes
match:
        $total_bytes

However, I receive the following error:
> Compilation error validating query: missing type info for placeholder $total_bytes

How can I correctly define a new field by summing two existing fields in Google SecOps?

Any guidance would be appreciated!

Regards,
Prashant Nakum

Best answer by AymanC

Hi @prashant_nakum,

Does the below help solve your use case?

 

rule Ayman_C_network_bytes { meta: author = "Ayman C" events: $test.principal.hostname = $Host $test.metadata.event_type = "NETWORK_CONNECTION" $test.network.received_bytes = $source_bytes $test.network.sent_bytes = $response_bytes match: $Host over 1h outcome: $TotalBytes = sum($source_bytes + $response_bytes) condition: $test }

Kind Regards,

Ayman

1 reply

AymanC
Forum|alt.badge.img+13
  • AymanCBronze 5
  • Bronze 5
  • Answer
  • February 14, 2025

Hi @prashant_nakum,

Does the below help solve your use case?

 

rule Ayman_C_network_bytes { meta: author = "Ayman C" events: $test.principal.hostname = $Host $test.metadata.event_type = "NETWORK_CONNECTION" $test.network.received_bytes = $source_bytes $test.network.sent_bytes = $response_bytes match: $Host over 1h outcome: $TotalBytes = sum($source_bytes + $response_bytes) condition: $test }

Kind Regards,

Ayman

Terms & ConditionsCookie settingsAccessibility statement
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.