The Google Cloud Security Community is upgrading platforms! Read more and check out our FAQ.

[VivekPuthan]

I would like to get a clarification on How to iterate through all the values if a field consist multiple values in comma separated array format. For example if I use this line the $mesgid = re.capture($e2.network.email.mail_id, "[^,]+")- re.capture will assign only first entry of the array to $mesgid. If I want to assign each values of the array to $mesgid and match it with another variable. What could be the ideal solution? I would be grateful if  anyone could help me here 

[tameri]

@VivekPuthan , did you try to use any as mentioned in the repeated fields here this https://cloud.google.com/chronicle/docs/detection/yara-l-2-0-syntax#repeated_fields