XQL : Need help with json_extract

Antony_Chan — Wed, 17 Jul 2024 08:54:28 GMT

Dear Community,

I was trying to use the json_extract to extract the value of "RuleActions" and have no success so far.

Sample data:

{"RuleOperation":"AddMailboxRule","RuleId":"0","RuleState":"Enabled, ExitAfterExecution","RuleCondition":"{(SubString IgnoreCase(SubjectProperty)=ABC Communication)}","RuleName":"ABC Communication","RuleProvider":"RuleOrganizer","RuleActions":"[{"ActionType":"Move","DestinationFolderId":"LgAAAAAugyiuv11hR6F4h74ucfwGAASDFVCEqNKZSaN2wuruT03jAAC7WAXhAAAB","FolderIsInThisStore":"True"}]"}

The value is always turned out to be "[{" instead of "[{"ActionType":"Move","DestinationFolderId":"LgAAAAAugyiuv11hR6F4h74ucfwGAASDFVCEqNKZSaN2wuruT03jAAC7WAXhAAAB","FolderIsInThisStore":"True"}]"

The syntax that I'm using is

RuleActions = json_extract(OperationProperties, "$.RuleActions")

FYI, I've tried json_extract_scalar, json_extract_array, json_extract_scalar_array and have no success.

Thank you in advance!

Re: XQL : Need help with json_extract

nsinghvirk — Thu, 18 Jul 2024 14:35:53 GMT

Hello @Antony_Chan

Thanks for reaching out on Live Community!

Please try following query format if you are looking for Action type value or replace it with whichever field you want.

RuleActions = json_extract(OperationProperties, "$.RuleActions.ActionType")

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

topic XQL : Need help with json_extract in Cortex XDR Discussions

XQL : Need help with json_extract

Re: XQL : Need help with json_extract