Skip to main content

We get chrome events for password reuse which are helpful and mostly include and ‘additional field’ entry for the category of URL

 

additional.fields["localized_url_category"] = "INTERNET_AND_TECHNOLOGY__WEB_DESIGN_AND_DEVELOPMENT"

 

Is it possible to filter out ones that have a category? i.e. only select ones that are unknown? 

 

I’ve tried 

 

$e.additional.fields["LOCALIZED_URL_CATEGORY"] !=/_+/

 

since most categories have an underscore, but it still selects unknowns. I’ve also tried =””  but it doesn’t appear to affect the selection criteria. 

You could try ; $e.additional.fields["LOCALIZED_URL_CATEGORY"] !=/_{1}/ , this will exclude all entries with only one underscore “_” .


Thanks! 
Tried that and I still get events where there are categories as well as events without categories. 

I’m thinking the field isn’t really searchable?


No it is searchable even using the key-value pairs separately, e.g; additional.fields.key = "LOCALIZED_URL_CATEGORY" AND additional.fields.value.string_value != /_{1}/


Could you share a sample of the field values from the query $e.additional.fields["LOCALIZED_URL_CATEGORY"] !=/_{1}/   ?
Is this field multi-valued ? 


Oh, this worked; pulled events where there is no category: 

 

metadata.product_event_type = "PASSWORD_REUSE"

AND

additional.fields.key != "LOCALIZED_URL_CATEGORY"

 

Thanks for the help!


Reply