Grouped Fields - URL

Good afternoon, 

Can I ask more around your use case for having URL's part of grouped fields? Grouped fields are aliases for groups of related UDM fields that allow you to query multiple UDM fields simultaneously, without needing to type each field individually.

That being said you can search all or part of URL's within SeCops using the 'group' function or a standard search using OR statements or a reference list / data table to search through your data. 

If I know more about your use case I can help a little further. 

​@darrenswift Its like you said, the grouped field functionality is very useful because of the ability to save space when crafting SIEM queries via API and not having to fear making a mistake and forget a field. 

The workarounds you suggest are certainly also applicable for other fields that are grouped like domain and ip, but they have grouped fields - hence my question on why grouped fields dont exist for url?

How can i define my own alias  

Hi ​@mani20701812,

You can use the YARA-L function ‘group’ [1]. For example:

$URLs = group(target.url, intermediary.url)
$URLs = /google\.com/

This is only applicable within search, otherwise you’ll have to use ‘or’ statements (if used in a rule for example) like so:

target.url = /google\.com/ or intermediary.url = /google\.com/

I’d suggest opening a feature request with Google Support, to introduce a pre-defined group field, similar to ones they have for ‘hostname’ or ‘ip’ etc

[1] - https://docs.cloud.google.com/chronicle/docs/yara-l/functions#group

Kind Regards,

Ayman