help with Query

[rahul7514]

Hi 

Has anyone experience this issue this field when copied or exported will show as security_result.action 

The challenge as a result is when i am writing the query in SIEM search  

security_result.action != "QUARANTINE" the above logs (security_result[1].action[0]:"QUARANTINE") are not getting captured . If I type security_result[1].action[0] != "QUARANTINE" in SIEM search it throws error message .

What should be the query in such cases ?

[AymanC · Accepted solution]

Hi @rahul7514,

This is a repeated field[1], a field type within the Unified Data Model (UDM) that can store multiple values in a key (array). What you can do is use key words to satisfy a condition for a value within a repeated field. These two key words are 'any' and 'all'. And you would call it using the UDM field like so: 

any security_result.action = "QUARANTINE"

[1] -  https://cloud.google.com/chronicle/docs/detection/yara-l-2-0-syntax#repeated_fields

Kind Regards,

Ayman