How to fetch UDM Additional Fields in Dashboard Query

You can reference the key directly as a map entry in the dashboard’s YARA-L query.

events:

  $e.additional.fields["eventAnnotationManagerTime"] != ""

outcome:

  $event_annotation_manager_time =

    array_distinct(

      $e.additional.fields["eventAnnotationManagerTime"]

    )

For a direct filter:

$e.additional.fields["eventAnnotationManagerTime"] = "<expected_value>"

A good reply would be:

additional.fields is map-addressable in YARA-L. Reference the key directly:

$e.additional.fields["eventAnnotationManagerTime"]

In a dashboard query, expose it through an outcome aggregation:

outcome:

  $event_annotation_manager_time =

    array_distinct(

      $e.additional.fields["eventAnnotationManagerTime"]

    )

The key is case-sensitive. Also verify the ingested UDM field type/value in Search first; if it is numeric rather than a string, use an appropriate numeric aggregation such as max() instead of array_distinct(). 

Let me know how it works. 

RQ

Thank you ​@whathehack81 

I forgot to mention I want to fetch this value with detection table. So I want something like this:

detection.collection_elements.references.event.metadata.[??] 

Similar to: For Event Timestamp I use >> detection.collection_elements.references.event.metadata.event_timestamp.seconds

thanks a lot ​@cmorris 

I noticed only after the comment was posted. Missed it by that much… 😁