Dashboard Regex

[JaredBloomberg]

Hello,

Does anyone know if there is a way to use regex within visualizations in the SIEM dashboards? Looker Studio has the 'REGEXP_EXTRACT' function which is exactly what I need but I gather that that is not what the SIEM dashboards are based off of? 

[AymanC · Accepted solution]

the Native SIEM dashboards use looker embedded, whereby a lot of the functions do exist, unfortunately REGEXP_EXTRACT doesn't. Depends on your use case, if it's for filtering you can use a 'matches advanced' and refer to the following reference ->  https://cloud.google.com/looker/docs/filter-expressions

For example, in the below i've got an advanced filter for within the Rule Detections explore, the column 'rule_name' with the expression 'G%' indicating that it filters out rule_name's that don't start with 'G'.

Without Advanced Filter:

With Advanced Filter:

However, if it's more to do with table calculations, the closest i've come across to achieving regex is the below example use case. use a combination of 'if' and 'contains'.

if(contains(${rule_detections__detection.rule_name}, "gct"), ${rule_detections__detection.rule_name}, "Doesn't contain gct")

If the rule name contains (wide regex search) 'gct' to populate the column with the rule name, else populate it with 'Doesn't contain gct'

Depending on your use case, if you're trying to extract certain text that are of a certain length you can look into using the likes of substring and position, with length for more complicated use cases.

Hope this helps!

Kind Regards,

Ayman C

[JaredBloomberg]

It's not exactly what I was looking for but should be close enough for me to make it work, thank you very much!