Filter Output By Category

[bereon]

Hello everyone,
I'm working with the Proofpoint EThreat,
I'm trying to filter the output feed based on ET category.

to archieve this, i'm editing the Output Node stlib with this condition:

- actions:
- accept
conditions:
- confidence > 75
- share_level == 'red'
- proofpoint_etintelligence_categories == 'VPN'
name: category CnC

But it doesn't work, probably because proofpoint_etintelligence_categories it's an Array

"proofpoint_etintelligence_categories": [
"Drop",
"VPN"
],

How can I filter with a condition (proofpoint_etintelligence_categories CONTAIN "category_name")

Thanks

[bereon · Accepted solution]

Found the solution:

contains(proofpoint_etintelligence_categories, 'category') == true