Extracting a multivalue key-value pair to multivalue field for lookup

[egrzeszczak]

Hello,

As I want to get my email events CIM compliant, I have trouble parsing a "disposition" key-value pair.

Example:

Having an event:

date=2024-01-09 time=11:59:43.258 device_id=XXXXXXXXXXXXXX log_id=0200012329 type=statistics pri=information session_id="4XXXXXXXXXXX-4XXXXXXXXXXXXX" client_name="example.com" disposition="Modify Subject;Insert Disclaimer;Defer Disposition" classifier="Data Loss Prevention" message_length="94756" subject="Test subject" message_id="xxxxxxxxxxxxxxxxxxxx@example.com" recv_time="" notif_delay="0" scan_time="0.186489" xfer_time="0.002166" srcfolder="" read_status="

I have disposition field extracted at search-time with the value "Modify Subject;Insert Disclaimer;Defer Disposition"

Want I need to do is to separate the values into a multivalue field, and then use a lookup to determine the action.

Lookup file:

vendor_action,action
Accept,delivered
Reject,blocked
Add Header,delivered
Modify Subject,
Quarantine,quarantined
Discard,blocked
Replace,
Delay,
Rewrite,
Insert Disclaimer,
Defer Disposition,delivered
Disclaimer Body,delivered
Disclaimer Header,delivered
Defer,
Quarantine to Review,quarantined
Content Filter as Spam,
Encrypt,
Decrypt,
Alternate Host,
BCC,
Archive,
Customized repackage,
Repackage,
Notification,

In the end, the event should have a field named action, and the value should for this example be delivered

My props.conf:

[fortimail]
...
...
LOOKUP-action = fortimail_action_lookup.csv vendor_action as disposition OUTPUT action
REPORT-disposition = disposition_extraction

My transforms.conf:

[disposition_extraction]
SOURCE_KEY = disposition
DELIMS = ";"
MV_ADD = true

But eventually i just end up with the original value ("Modify Subject;Insert Disclaimer;Defer Disposition") and it doesn't get separated

What am I doing wrong?

[egrzeszczak]

After a while I solved my problem with a EVAL statement 🙂

My props.conf is now:

...
...
EVAL-disposition_split = split(disposition, ";")
LOOKUP-action = fortimail_action_lookup.csv vendor_action AS disposition_split OUTPUT action