Filter Output By Category

bereon — Tue, 12 Jan 2021 09:48:14 GMT

Hello everyone,
I'm working with the Proofpoint EThreat,
I'm trying to filter the output feed based on ET category.

to archieve this, i'm editing the Output Node stlib with this condition:

- actions:
- accept
conditions:
- confidence > 75
- share_level == 'red'
- proofpoint_etintelligence_categories == 'VPN'
name: category CnC

But it doesn't work, probably because proofpoint_etintelligence_categories it's an Array

"proofpoint_etintelligence_categories": [
"Drop",
"VPN"
],

How can I filter with a condition (proofpoint_etintelligence_categories CONTAIN "category_name")

Thanks

Re: Filter Output By Category

bereon — Tue, 12 Jan 2021 13:12:53 GMT

Found the solution:

contains(proofpoint_etintelligence_categories, 'category') == true

topic Filter Output By Category in General Topics

Filter Output By Category

Re: Filter Output By Category