topic How to extract new fields from a JSON array? in Getting Data In

How to extract new fields from a JSON array?

James_ACN — Fri, 29 Oct 2021 15:38:39 GMT

Hi All!

How to extract and create different fields by transforms when there is an array (JSON) with several fields with the same name but different values?
For example, the "text" field in the first case means "action", in the second the "text" field means "hostname".
Just like "port" that appears twice would have to be identified as src_port and dst_port.

Sample:

"{
detail: {
      indicators: [
       {
         filterId: [
         ]
         id: 1
         objectType: port
         objectValue: 445
         relatedEntities: [
         ]
       }
       {
         filterId: [
         ]
         id: 2
         objectType: text
         objectValue: Reset
         relatedEntities: [
         ]
       }
       {
         filterId: [
         ]
         id: 3
         objectType: port
         objectValue: 36880
         relatedEntities: [
     ]
       }
       {
filterId: [
         ]
         id: 6
         objectType: text
         objectValue: SERVERWIN01
         relatedEntities: [
         ]
       }
       {
         filterId: [
         ]
         id: 7
         objectType: detection_name
         objectValue: Microsoft Windows SMB Information Disclosure Vulnerability (CVE-2017-0147)
         relatedEntities: [
         ]
   }"

Thanks!

James

Re: How to extract new fields from a JSON array?

PickleRick — Fri, 29 Oct 2021 15:59:46 GMT

Firstly, it looks like an output of spath command, not the automatic json extraction (the automatic extraction doesn't understand json structure and just uses "final" field names).

Secondly, how would you distinguish between different ports? You can of course retrieve specific value of multivalue field by mvindex() but are you sure that src port will always be firts value? And so on?

Re: How to extract new fields from a JSON array?

James_ACN — Tue, 09 Nov 2021 12:54:55 GMT

Hi All!

I still haven't been able to solve this problem.

Does anyone have any outline suggestions?

Thanks!

James \°/