Skip to main content

Hello Team,

I am trying to filter telemetry based on the values in a array: security_result.detection_fields.value

for example:

metadata.log_type = "test"
security_result.detection_fields.value[0] != "No" and
security_result.detection_fields.value[1] != "No" and
security_result.detection_fields.value[2] != "No" and
$host = 
target.asset.hostname

match:
$host


The idea is to check if the first 3 values in a array is not equal to "NO", if all the three conditions match, then get the count of the host. 
i am struggling in the condition where i try to check the values of array. is there any way to check conditions in array ?

thanks.

Hi,
Please try the following:

metadata.log_type = "test"
any security_result.detection_fields.value != "No" 

$host = target.asset.hostname

match:
$host

*you can use "any " to check across all values


Hi,
Please try the following:

metadata.log_type = "test"
any security_result.detection_fields.value != "No" 

$host = target.asset.hostname

match:
$host

*you can use "any " to check across all values


Hi Eoved,

thanks for the reply. i tried the below. but it does not work

metadata.log_type = "test"
any security_result.detection_fields.value != /No violation/ nocase

I am trying to check if the values of array contains no violation. Can you help?

Hi Eoved,

thanks for the reply. i tried the below. but it does not work

metadata.log_type = "test"
any security_result.detection_fields.value != /No violation/ nocase

I am trying to check if the values of array contains no violation. Can you help?

Try:

metadata.log_type = "test"
not any security_result.detection_fields.value = /No violation/ nocase

I did a similar query in my lab, and it should work.



Try:

metadata.log_type = "test"
not any security_result.detection_fields.value = /No violation/ nocase

I did a similar query in my lab, and it should work.



thanks it works !!


Reply