-
Notifications
You must be signed in to change notification settings - Fork 46
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Source file parse doesn't ignore '.' #7
Comments
hey @CptOfEvilMinions I think we've talked about this indirectly in other places but I haven't responded here. With EQL a This is an interesting scenario, because we currently require all field names to match Since
Then your EQL queries would look like one of these network where id\.orig_h == "192.168.1.1"
network where ["id.orig_h"] == "192.168.1.1"
network where .["id.orig_h"] == "192.168.1.1" Also since your blog, it should be a lot easier to make your own schema, and EQL will autodetect it from your JSON file if you use the new interactive shell Any preferences for the syntax? |
Resolved by endgameinc/eql#19 |
I created a custom source file to parse BRO logs. By default BRO has key names containing dots like
id.orig_h
orid.resp_h
. When I do the followingdestination_address = 'id.orig_h'
and run eqllib it ignores this mapping. However, if I manually changeid.orig_h
todest_addr
in the JSON log file and change my source file statement todestination_address = 'dest_addr'
it works.bro-source.toml
bro-domain.toml
The text was updated successfully, but these errors were encountered: