How to exclude Enriched field values when checking for a match in detections?

Hello,
There are multiple ways to exclude fields and enriched values  in a detection rule.
Can you share sample logs (without real data) and the specific fields you want to exclude?

Hi ​@lalji_d,

Potentially, if it’s a repeated field of which could contain enriched data, could you call the first element, typically this would be an unenriched field.

principal.user.email_addresses[0]

Kind Regards,

Ayman

Hello ​@Eoved , 

So I want to check for the filename against a data table which has a list of files which I want to detect if they are being running in the environment or not.


For example I am using regex to derive the filename and checking for that in the list.

$file_name = re.replace($e.target.process.file.names, `^.*[\\/]`, ``)  
$file_name in %Tools.tools_list nocase  

So in this case lets say the unenriched field is the first one marked U and I check that against the list its not there but since the list has test.exe getting a hit for that.

U target.process.file.names[0]:""c:\\dummy\\path\\cmd.exe"

E target.process.file.names[1]:"c:\\dummy\\path\\dummycmd.exe"

E target.process.file.names[2]:"C:\\Dummy\\Path\\test.exe"

E target.process.file.names[3]:"C:\\DUMMY\\Path\\Dummyfile.exe"

Thanks

Hi ​@AymanC ,

That works, but I was just not sure if that's always the case as I have seen  sometimes it comes as second or third element.

Also are there any other ways of doing this?

Thanks

Hi ​@AymanC 

Yeah I mapped the file names to an unenriched field and that works.
Thank you for the help!