I have a field that his elements looks the following:
["bedep","banjori","gameover","dyre","suppobox","necurs","unknown","conficker","kraken","emotet","mirai","virut","ccleaner"]
How can I only extract the names of the threats with "" from the array on a different field?
By using split:
| makeresults
| eval name="[\"bedep\",\"banjori\",\"gameover\",\"dyre\",\"suppobox\",\"necurs\",\"unknown\",\"conficker\",\"kraken\",\"emotet\",\"mirai\",\"virut\",\"ccleaner\"]"
| eval new_name = name
| rex field=new_name mode=sed "s/\[|\]|\"//g"
| eval new_name = split(new_name,",")
Like this:
| makeresults
| eval name="[\"bedep\",\"banjori\",\"gameover\",\"dyre\",\"suppobox\",\"necurs\",\"unknown\",\"conficker\",\"kraken\",\"emotet\",\"mirai\",\"virut\",\"ccleaner\"]"
| eval new_name = name
| rex field=new_name mode=sed "s/[\[\]]//g"
| makemv delim="," new_name
| rex field=new_name mode=sed "s/\"//g"
Hi
Try this
| makeresults
| eval name="[\"bedep\",\"banjori\",\"gameover\",\"dyre\",\"suppobox\",\"necurs\",\"unknown\",\"conficker\",\"kraken\",\"emotet\",\"mirai\",\"virut\",\"ccleaner\"]"
| eval result = replace(name, "\[|\]|\"","")
| makemv delim="," result