A developer here wrote the following -
|eval admin_activity=if((like(cmd_data, "%audit%") AND like(cmd_data, "%start=%") AND NOT like(cmd_data, "%end=%")), "Login Attempt", NULL)
|eval admin_activity=if((like(cmd_data, "%audit%") AND like(cmd_data, "%start=%") AND like(cmd_data, "%end=%") AND isnull(admin_activity)), "Login Success", NULL)
|eval admin_activity=if((like(cmd_data, "%transaction%") AND isnull(admin_activity)), "Config Change", NULL)
We end up having admin_activity
only as Config Change
because the last eval
nullifies the findings from the above two evals
.
What can we do here?
Merge them in single eval-case , like this, so it stops overwriting value of admin_activity after first condition is true.
|eval admin_activity=case((like(cmd_data, "%audit%") AND like(cmd_data, "%start=%") AND NOT like(cmd_data, "%end=%")), "Login Attempt", (like(cmd_data, "%audit%") AND like(cmd_data, "%start=%") AND like(cmd_data, "%end=%") AND isnull(admin_activity)), "Login Success", (like(cmd_data, "%transaction%") AND isnull(admin_activity)), "Config Change", true(), null())
hi @danielbb
You need to use a single eval
|eval admin_activity=if((like(cmd_data, "%audit%") AND like(cmd_data, "%start=%") AND NOT like(cmd_data, "%end=%")), "Login Attempt", if((like(cmd_data, "%audit%") AND like(cmd_data, "%start=%") AND like(cmd_data, "%end=%") AND isnull(admin_activity)), "Login Success",if((like(cmd_data, "%transaction%") AND isnull(admin_activity)), "Config Change", NULL)))
Merge them in single eval-case , like this, so it stops overwriting value of admin_activity after first condition is true.
|eval admin_activity=case((like(cmd_data, "%audit%") AND like(cmd_data, "%start=%") AND NOT like(cmd_data, "%end=%")), "Login Attempt", (like(cmd_data, "%audit%") AND like(cmd_data, "%start=%") AND like(cmd_data, "%end=%") AND isnull(admin_activity)), "Login Success", (like(cmd_data, "%transaction%") AND isnull(admin_activity)), "Config Change", true(), null())