Mapping labels "message" to Incident Context without Regex

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Mapping labels "message" to Incident Context without Regex

L0 Member

Kind of similar to the below link:

LIVEcommunity - Cortex XSOAR Context Issue - LIVEcommunity - 437729 (paloaltonetworks.com)

 

I've tried mapping content from the Abnormal Security integration and from the Syslog v2 integration. The Abnormal Security integration dumps the raw logs into labels.messages, meanwhile Syslog dumps the whole raw log into details.  Is there a way to parse out chunks of data without using regex in every field of the incoming mapper?

1 accepted solution

Accepted Solutions

L0 Member

Looks like this is supposed to be auto mapped. Threat logs fetch from the Abnormal Security integration isn't parsing rawJson correctly so it comes in as one message. Campaigns and takeover requests are parsing correctly. Will contact vendor for support.

On a side note, an easier approach than using regex to get the fields from labels.messages is to apply ParseJson transformer and then use Get field transformer to grab the value of the key,value pairs within the json message. 

View solution in original post

1 REPLY 1

L0 Member

Looks like this is supposed to be auto mapped. Threat logs fetch from the Abnormal Security integration isn't parsing rawJson correctly so it comes in as one message. Campaigns and takeover requests are parsing correctly. Will contact vendor for support.

On a side note, an easier approach than using regex to get the fields from labels.messages is to apply ParseJson transformer and then use Get field transformer to grab the value of the key,value pairs within the json message. 

  • 1 accepted solution
  • 855 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!