Hello Team,
I am trying to filter telemetry based on the values in a array: security_result.detection_fields.value
for example:
metadata.log_type = "test"
security_result.detection_fields.value[0] != "No" and
security_result.detection_fields.value[1] != "No" and
security_result.detection_fields.value[2] != "No" and
$host = target.asset.hostname
match:
$host
The idea is to check if the first 3 values in a array is not equal to "NO", if all the three conditions match, then get the count of the host.
i am struggling in the condition where i try to check the values of array. is there any way to check conditions in array ?
thanks.