can you try something like "principal.user.username = "username" AND principal.user.username IN reference_list"

Hi @skadav,

If you wanted to do something cooler (below is based on IP), you could do the below POC.

Alternatively, the below will only show the events within the reference list

 Kind Regards,

Ayman

Thank you for suggestions @nelsonlam  and @AymanC 

But, I am primarily looking to retrieve matching data from the reference list, rather than identifying data on the console that matches the reference set.

to elaborate more,

I am planning to store below in Reference list:
username=suraj kadav;designation=security platform engineer; location=remote;etc;etc 
username=demo test;designation=testing; location=remote;etc;etc 

and once I ran stat query:

user != "" and principal.user.userid in regex %Log_Source_Type

$user = principal.user.userid

match:

    $user

outcome:

    $info = (info from Reference List)

the output should look like:

 

Thank you for suggestions @nelsonlam  and @AymanC 

But, I am primarily looking to retrieve matching data from the reference list, rather than identifying data on the console that matches the reference set.

to elaborate more,

I am planning to store below in Reference list:
username=suraj kadav;designation=security platform engineer; location=remote;etc;etc 
username=demo test;designation=testing; location=remote;etc;etc 

and once I ran stat query:

user != "" and principal.user.userid in regex %Log_Source_Type

$user = principal.user.userid

match:

    $user

outcome:

    $info = (info from Reference List)

the output should look like:

 

Hi skadav,

Reference Lists don't support multi-dimensions. Their upcoming replacements, Data Tables, do. You should be able to do what you want then. I'm not sure how the mechanics will work just yet?  Maybe your $info in the outcome field will work via a strings_concat function?  You might also be able to join on the data table in the Events section (up top). This is me guessing since I haven't played with it enough yet to know exactly I'd make that work.

Are there any docs written up on this yet or a pre-GA preview option available for those of us that would want to test "data tables" -- This is the first i've heard of a replacement for reference lists and I can't find anything in the API docs etc about them.

Thanks!

Nothing yet.  When it's put out in public preview there will be docs visible on this page: https://cloud.google.com/chronicle/docs/preview

I suggest you create an alert to monitor it.