Hi everyone,
It might me a silly question 🙂
The simplified case.
3 artifacts within the event with 3 different IP addresses:
192.168.0.1
192.168.0.2
8.8.8.8
I'm trying to check if IP is local and make separate queries to the crowdstrike (it could be any other app).
Each query should use filter parameter local_ip:"{0}", so I'm using a Format gadget.
I'm getting a error during the execution because "Format" function returns joined value: local_ip:"192.168.0.1, 192.168.0.2". And then it launches crowdstrike app just ones with this filter. But it should be 2 different request with a separate IP address in each one.
I tried to use as a filter parameter for the crowdstrike app:
"format_2:formatted_data.*" - returns None
"format_2:formatted_data" - returns "192.168.0.1, 192.168.0.2" as one string
So, how to make 2 different requests here?
Thanks.
... View more
