+4Hi everyone,
I'm working on a Google SecOps Preview Dashboard and need to calculate the length of a string.
I have a use case where I need to calculate the length of string field (f1) and then compute the average length across all events.
For example:
| ID | f1 | len(f1) |
| 1 | "val-1" | 5 |
| 2 | "v-2" | 3 |
| 3 | "value-3" | 7 |
I need to display AVG(len(f1)).
Is there a built-in function for this, or is there any workaround to achieve it?
Any guidance would be greatly appreciated!
Thanks,
Prashant Nakum
Best answer by jstoner
Yes, couple of functions actually.
Here's a video on strings.length: https://www.googlecloudcommunity.com/gc/Google-Security-Operations/Getting-to-Know-Google-SecOps-String-Function-String-Lengths/ta-p/823148
And a blog on it as well https://www.googlecloudcommunity.com/gc/Community-Blog/New-to-Google-SecOps-Turning-Strings-into-Integers-for/ba-p/799984
Here's one on statistical functions including average https://www.googlecloudcommunity.com/gc/Community-Blog/New-to-Google-SecOps-New-Statistical-Functions-in-Search-and/ba-p/792398
And below is one way to go about doing what you are asking. In this case I am grouping/aggregating by hostname so that might change for what you are doing but hopefully this is a good template to get you started.
metadata.event_type = "PROCESS_LAUNCH"
target.process.command_line != ""
$command_length = strings.length(target.process.command_line)
match:
principal.hostname
outcome:
$event_count = count(metadata.event_type)
$avg_length = window.avg($command_length)
+22Yes, couple of functions actually.
Here's a video on strings.length: https://www.googlecloudcommunity.com/gc/Google-Security-Operations/Getting-to-Know-Google-SecOps-String-Function-String-Lengths/ta-p/823148
And a blog on it as well https://www.googlecloudcommunity.com/gc/Community-Blog/New-to-Google-SecOps-Turning-Strings-into-Integers-for/ba-p/799984
Here's one on statistical functions including average https://www.googlecloudcommunity.com/gc/Community-Blog/New-to-Google-SecOps-New-Statistical-Functions-in-Search-and/ba-p/792398
And below is one way to go about doing what you are asking. In this case I am grouping/aggregating by hostname so that might change for what you are doing but hopefully this is a good template to get you started.
metadata.event_type = "PROCESS_LAUNCH"
target.process.command_line != ""
$command_length = strings.length(target.process.command_line)
match:
principal.hostname
outcome:
$event_count = count(metadata.event_type)
$avg_length = window.avg($command_length)
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
