Page History

...

• Referencing fields in the enriched JSON
• Simple boolean operations: 
  • and, &&
  • not
  • or,
  or
  • ||
• Determining whether a field exists (via exists)
• The ability to have parenthesis to make order of operations explicit
• A fixed set of functions which take strings and return boolean. Currently:
  • IN_SUBNET(ip, cidr1, cidr2, ...)
  • IS_EMPTY(str)
  • STARTS_WITH(str, prefix)
  • ENDS_WITH(str, suffix)
  • REGEXP_MATCH(str, pattern)
• A fixed set of string to string transformation functions.  Currently:
  • TO_LOWER
  • TO_UPPER
  • TRIM

...

{

  ...

  ,"threatIntel" : {

            ...

           , "triageConfig" : {

                     "riskLevelRules" : {

                                 "condition1" : level1

                               , "condition2" : level2

                                  ...

                                                  }

                     ,"aggregator" : "MAX"

                                      }

                        }

}

 riskLevelRules correspond to the set of condition to numeric level mappings that define the threat triage for this particular sensor. aggregator is an aggregation function that takes all non-zero scores representing the matching queries from riskLevelRules and aggregates them into a single score.  The current supported aggregation functions are

...