Skip to main content
Question

Issue with Google Chronicle UDM query

  • May 7, 2026
  • 1 reply
  • 17 views

Lathar23

I have written a query to fetch the key value pair correct .But the result is not accurate .
Could you please anyone guide me to get the key vale from repeated list ?
 

($e.target.resource_ancestors.attribute.labels.key = "res_spec_container_security_context_privileged" AND

  $e.target.resource_ancestors.attribute.labels.value = "true")

1 reply

cmorris
Staff
Forum|alt.badge.img+12
  • Staff
  • May 7, 2026

Try this syntax:

target.resource_ancestors.attribute.labels["key"] = "value"

 

So in your example:

target.resource_ancestors.attribute.labels["res_spec_container_security_context_privileged"] = "true"