Skip to main content

Hey folks, 

I wanted to dive into some network related use cases in Chronicle and stumpled upon a problem regarding managing ports in reference lists. When trying to query the ref-set inside YARAL, I receive a mismatch error, because ports are parsed as int: 

  • $network.target.port in %uncommon_ports
  • validating intermediate representation: type mismatch between "%uncommon_ports" of type string and "network.udm.target.port" of type int

As there is no type casting/conversion function available, what other options exits besides inputting all entries/ports inside the rule seperated by ORs? Thanks!

 

 

 

Hi @maxjunker. Try this:


events:
$e.metadata.event_type = "NETWORK_CONNECTION"
$target_port = strings.concat($e.target.port,"")
$target_port in %test_uncommon_ports_1

 


 


thanks @David-French! Thats exactly what is was hoping for.

Reply


Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.