Took me a while to get this figured out, but @lachlanjholmes on the PA community slack group had the answer and want to credit him.
I'm posting it here to help others in case who may have a similar issue.
Parsing a JSON feed that contains an array of ip addresses, like the datadog feeds:
{
"version": 40,
"modified": "2021-04-02-17-00-00",
"agents": {
"prefixes_ipv4": [
"3.228.26.0/25",
"3.228.26.128/25",
"3.228.27.0/25",
"3.233.144.0/20"
],
"prefixes_ipv6": [
"2600:1f18:24e6:b900::/56",
"2600:1f18:63f7:b900::/56"
]
}
}
you need to use the extractor:
extractor: agents.prefixes_ipv4[].{ip:@}
The extractor get's the prefixes_ipv4[] array, then the {ip:@} formats that into an array of objects like the following:
[
{
"ip": "3.228.26.0/25"
},
{
"ip": "3.228.26.128/25"
},
{
"ip": "3.228.27.0/25"
},
{
"ip": "3.233.144.0/20"
}
]
Then it's a simple matter of using
indicator: ip
To extract each ip to the list.
... View more