topic Re: XQL filter o365 attachments in Cortex XDR Discussions

XQL filter o365 attachments

FabioFerreira — Thu, 31 Aug 2023 11:21:04 GMT

Hi,

I am trying to filter o365 attachments without success, could you help pls

sample

[ { "@odata.type": "#microsoft.graph.fileAttachment", "@odata.mediaContentType": "image/jpeg", "id": "AAMkADEzYjJhMzM1LTY0ODctNGUxOS05ZDc5LTQ2MWM3NzFmMTRjOABGAAAAAABaN8y0q3IrQ6fyDga7Z5M3BwBvSXHDOoi0TJ5-l2B-i9PgAAAAAAEMAADyHfSb-T8wR5Fak3aFlfaBAACPB9PLAAABEgAQAE8kDtOZeABMuRd54VyYgc4=", }, { "@odata.type": "#microsoft.graph.fileAttachment", "@odata.mediaContentType": "image/png", "id": "AAMkADEzYjJhMzM1LTY0ODctNGUxOS05ZDc5LTQ2MWM3NzFmMTRjOABGAAAAAABaN8y0q3IrQ6fyDga7Z5M3BwBvSXHDOoi0TJ5-l2B-i9PgAAAAAAEMAADyHfSb-T8wR5Fak3aFlfaBAACPB9PLAAABEgAQAI8pDv4IgY1BhJhVm9_2_E8=", } ]

XQL

dataset = msft_o365_emails_raw | | fields attachments as attach | alter attachid = json_extract_scalar_array(to_json_string(arrayindex(attach, 0)) , "$.id")

Regards,

Fabio Ferreira

Re: XQL filter o365 attachments

PiyushKohli — Fri, 01 Sep 2023 08:51:52 GMT

Hi @FabioFerreira

Thank you for writing to live community!

Assuming type of the field which contains above value is json, could you try this below:

| alter attachment_id = arraymap(json_extract_array(to_json_string(fieldname),"$."),json_extract_scalar("@element","$.id"))
| arrayexpand attachment_id

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Regards.

Re: XQL filter o365 attachments

SuporteDVT — Mon, 04 Sep 2023 09:47:19 GMT

Hi @PiyushKohli

It worked!

Thanks a lot 🙂

Regards,