Hello everyone, I'm working with the Proofpoint EThreat, I'm trying to filter the output feed based on ET category. to archieve this, i'm editing the Output Node stlib with this condition: - actions: - accept conditions: - confidence > 75 - share_level == 'red' - proofpoint_etintelligence_categories == 'VPN' name: category CnC But it doesn't work, probably because proofpoint_etintelligence_categories it's an Array "proofpoint_etintelligence_categories": [ "Drop", "VPN" ], How can I filter with a condition (proofpoint_etintelligence_categories CONTAIN "category_name") Thanks
... View more