The Google Cloud Security Community is upgrading platforms! Read more and check out our FAQ.

[RLee11212016]

I need to map specifically internet message ids from the Office 365 logs. Issue is in the mailitemsaccess logs that are bind events, multiple internet message ids can be captured within a single json path. I need to be able to iterate through and grap all the internet message IDs and map them to say additional.fields["InternetMessageIDs"]. Sometimes there can be up to 10 IDs within one log. I would like for them to be captured as additional.fields["InternetMessageIDs[0]"] or something similar when I use the extract function built in. It will only grab the first 5 IDs though so it has a limitation. Example of how it captures the data.

extracted.fields["Folders[0].FolderItems[0].InternetMessageId"]

extracted.fields["Folders[0].FolderItems[1].InternetMessageId"]

extracted.fields["Folders[0].FolderItems[2].InternetMessageId"]

and so on.

Not really sure of where to start on this as I have created basic extensions but nothing this complicated. Google support has not been that great a help with this either so far hence why I am trying to tackle this myself.

[Eoved]

Hello friend,

For a long-term solution, I would recommend submitting a parser improvement support case with the relevant type of logs. Since MailItemsAccessed can include a lot of elements, there's likely always room for improvement.

For a short-term solution, since the extract function doesn't meet your needs, I suggest creating a parser extension and mapping it to the UDM field. UDM offers more flexibility than the extract function, and since your log is in JSON format, you can use a no-code extension.

I believe you'll find the field "udm.principal.network.email.mail_id" very useful.

Sample:

Hope this helps!

[sudeep_singh]

Hi @RLee11212016 ,

If you can share me the raw log we can give a try using the for loop.

Thanks,
Sudeep Singh

[ScottieJ]

You may find this article helpful as its on topic for your request.