Test Rule not matching UDM Search results

Have you tried using no case on the vendor_name in the rule. Your search has case sensitivity turned off, but cannot be turned off for rules.

Hello ​@EP0,

I also have the same error with your query in our instance (we also have ZSCALER_WEBPROXY logs).

I was able to find your issue.

security_result is a repeated field, with zscaler logs you can have multiple of them.

The trick is that not all of them will contain some of the udm fields you are requesting such as category_details. By default in a rule, it will stop at the first instance of security_result.

To solve your issue, just put “any” in front of each security_result condition, and you will get hits in the rule engine. 

Below is my working rule I built using the exact same logic you wanted:

events:
  $e.metadata.log_type = "ZSCALER_WEBPROXY"
  $e.metadata.event_type = "NETWORK_HTTP"
  $e.security_result.action = "BLOCK"
  (
    any $e.security_result.threat_name = /malicious behavior/ nocase or  
    any $e.security_result.description = /malicious/ nocase or 
    any $e.security_result.associations.description = /sandbox/ nocase
  )
  any $e.security_result.category_details = /Download|Shareware|FileHost/ nocase

outcome:
  $ip = $e.principal.ip
  $url = $e.target.url

I suppose that by default the search engine is unesting all the repeated fields which cause the gap of results between your search and rule identical query. Or just that the order is randomized and it was just bad luck to have results in the search engine.

ps: I removed the vendor, as you already have the log type filter which is more resilient (can’t be changed unless you recreate your feed, less prone to parser change or raw log modification).