Log StreamLog Stream Guide

$.vendor

Extracts the value from the vendor_name field.

Exabeam

$.activity_type

Extracts the value from the activity_type field.

rule-trigger

$.entities[0].field_value

Extracts the first field_value of the entities array.

foo@acme

$.activity_type

with the following Extraction Condition: $.activity_type = "rule-trigger"

Extracts the value that matches a specific condition. In this example, the value of the activity_type field is extracted only when the following condition in the Extraction Condition column is met: $.activity_type = "rule-trigger"

rule-trigger

$.rules[?(@.type == 'CR')].rule_id

Extracts a field value based on a specific filter condition. In this example, the rule_id value is extracted only when the rule is a correlation rule (type = CR).

r1, r3

$.rules[?(@.severity == 'high')].rule_id

Extracts a rule_id value only if the severity is high.

r1

$.rules[?(@.type == 'BEAM')].rule_id

Extracts a rule_id value only if the rule type is BEAM

r2

$.dynamic_field

Extracts the entire dynamic object as a single field.

{fieldA:value1, fieldB:value2, fieldC:value3}

$.dynamic_fields.*

Extracts all values from a dynamic object

value1, value2, value3

$..technique_key

Extracts recursive values from all occurrences of the technique_key field.

T1071, T1072, T1073

$..field_value

Extracts recursive values from all occurrences of the field_value field, anywhere in the JSON structure.

foo@acme, bar@xyz

$..tags[*]

Extracts recursive values from all occurrences of the tag field.

t1, t2

$..rule_source

Extracts recursive values from all occurrences of the rule_source field.

CR, BEAM

$..rule_usecases

Extracts recursive values from all occurrences of the use_case field.

user case1, use case2

$..fieldB

Extracts recursive values from all occurrences of the fieldB field.

value2

$.entities[0].field_value

with the following Regex Substring: ({user_name}[^@]+)

Extracts the value of a substring from the first field_value in the entities array. In this example, the user_name substring value is extracted from the field_value by adding the following regex to the Substring Regex column: ({user_name}[^@]+)

foo

$.entities[0].field_value

with the following Regex Substring: ({domain}@(.+))

Extracts the value a substring from the first field_value in the entities array. In this example, the domain substring value is extracted from the field_value by adding the following regex to the Substring Regex column: ({domain}@(.+))

acme

$.rules[0].mitre_labels[0].technique_key

with the following Regex Substring: ({technique_number}T(\d+))

Extracts a value from a nested field. In this example, the first technique_key value is extracted from the first mitre_labels array in a rules array. The value is extracted by adding the following regex to the Substring Regex column: ({technique_number}T(\d+))

T1071

$.rules

Extracts the entire rules array object.

[
  {
    "rule_source": "CR",
    "rule_id": "r1",
    "rule": "rule name",
    "rule_reason": "resolved rule reason",
    "rule_severity": "correction prority",
    "type": "Brute Force",
    "rule_usecases": [
      "use case1",
      "use case2"
    ],
    "tags": [
      "t1",
      "t2"
    ],
    "mitre_labels": [
      {
        "technique_key": "T1071",
        "technique": "Valid Accounts",
        "tactic": "Privilege Escalation",
        "tactic_key": "TA0004"
      },
      {
        "technique_key": "T1072",
        "technique": "Valid Accounts",
        "tactic": "Initial Access",
        "tactic_key": "TA0001"
      }
    ]
  },
  {
    "rule_source": "BEAM",
    "rule_id": "r2",
    "rule": "rule name",
    "rule_reason": "resolved rule reason",
    "rule_severity": "correction prority",
    "type": "Brute Force",
    "rule_usecases": [
      "use case1",
      "use case2"
    ],
    "tags": [
      "t1",
      "t2"
    ],
    "mitre_labels": [
      {
        "technique_key": "T1073",
        "technique": "Valid Accounts",
        "tactic": "Privilege Escalation",
        "tactic_key": "TA0004"
      },
      {
        "technique_key": "T1074",
        "technique": "Valid Accounts",
        "tactic": "Initial Access",
        "tactic_key": "TA0001"
      }
    ]
  }
]

$.rules[0].rule_id

Extracts the first rule_id value from the rules array.

r1

$.rules[*].rule_id

Extracts a list of all rule_id values from the rules array.

r1, r2

$.metadata_tags[0]

Extracts the first metadata_tag value from a metadata_tags array.

Tag1

$.metadata_tags[*]

Extracts a list of metadata_tag values from a metadata_tags array.

Tag1, Tag2, Tag3

$.rules[*].mitre_labels

Extracts the nested values of all the fields in the mitre label array inside the rules array.

[
  [
    {
      "technique_key": "T1071",
      "technique": "Valid Accounts",
      "tactic": "Privilege Escalation",
      "tactic_key": "TA0004"
    },
    {
      "technique_key": "T1072",
      "technique": "Valid Accounts",
      "tactic": "Initial Access",
      "tactic_key": "TA0001"
    }
  ],
  [
    {
      "technique_key": "T1073",
      "technique": "Valid Accounts",
      "tactic": "Privilege Escalation",
      "tactic_key": "TA0004"
    },
    {
      "technique_key": "T1074",
      "technique": "Valid Accounts",
      "tactic": "Initial Access",
      "tactic_key": "TA0001"
    }
  ]
]

$.rules[*].mitre_labels[*]. technique_key

Extracts the value of all technique key values from each nested mitre_labels array inside the rules array.

T1071, T1072, T1073,T1074

$.rules[*].mitre_labels[0]. technique_key

Extracts the value of each technique key from the first nested mitre_label array in each rule in the rules array.

T1071, T1073

$.rules[0].mitre_labels[*]. technique_key

Extracts the value of each technique key from the all of the nested mitre_label in the first rule of the the rules array.

T1071, T1072

$.rules[*].mitre_labels[*].tactic

Extracts the value of all tactic values from each nested mitre_labels array inside the rules array.

Privilege Escalation, Initial Access