topic Re: XQL use to or operator in the Regextract in Cortex XDR Discussions

XQL use to or operator in the Regextract

AtilaTasli — Thu, 28 Mar 2024 09:40:17 GMT

I want to use or operator in XQL regextraxt but the following command does not work. Can you help us.
Thank you.

|alter etki=regextract(message ,"Etki\sAlanı\sAdı\:\s+([^\n\r]+) | Domain\sName\:\s+([^\n\r]+)")

Re: XQL use to or operator in the Regextract

jmazzeo — Mon, 01 Apr 2024 18:53:39 GMT

Hi @AtilaTasli, thanks for reaching us using the Live Community.

Please remove the whitespaces at each side of the "|" character and try again.

If this post answers your question, please mark it as the solution.

Re: XQL use to or operator in the Regextract

AtilaTasli — Mon, 01 Apr 2024 19:20:02 GMT

Hi Jmazzeo,

Thank you for your response. But When I do as you specified in XQL, I get "
Could not be executed because your query is invalid." error.

My XQL query

dataset =microsoft_windows_raw
|alter etki=regextract(message ,"Etki\sAlanı\sAdı\:\s+([^\n\r]+)|Domain\sName\:\s+([^\n\r]+)")

In our event logs, we will use the logs we receive from Turkish and English operating systems in correlations. This "OR" operator will make our job really easy.
I can get the result I need with the query below, but I need to write a lot of code.

dataset =microsoft_windows_raw

|change domain1=arrayindex(regextract(message , "Domain\sArea\sName\:\s+([^\n\r]+)"),0 )
|change domain2=arrayindex(regextract(message , "Domain\sName\:\s+([^\n\r]+)"),0)

|alter final_domain_name=
if (domain1!= "",
domain1,
domain2 )

|limit 100
|fields final_domain_name ,*