Need help on lookup table JSON

[blason]

Well I wanted to query a domain and extract both the fields in single lookup. I guess I wasnt clear enough in my previous attempt.

Lets say below is the entry

bad.com,APT,High

so if bad.com is found by Lookup Table

attackname: APT
Severity: High

Both the options will be tagged by single lookup? Else I will have to create one more lookup table and for each domain two API lookups will be used. Hence wondering if it can be done in single lookup?

[derPhlipsi (Philipp Ruland)]

For an answer I need one info: How are you planning on using the lookup table? As a message decorator? As a pipeline function? As a extractor converter?

Because I gave you an answer on how to extract both fields at the same time:

@derPhlipsi

However, I would use this approach:

rule "addThreatInfo"

when
    contains("EMOTET,THREAT,SOMEOTHERVALUETOACTUPON", to_string(lookup_value("threatUrlLookup", $message.url))) // Use contains() to check against a list of values to act on.
then
    let lookupResult = lookup("threatUrlLookup", $message.url); // Do Lookup.
    set_field("url_attack", lookupResult.attack); // Set every field individually to remove excess clutter from lookup.
    set_field("url_threat_severity", lookupResult.severity);
    set_field("url_threat_timestamp", lookupResult["@timestamp"]); // Use array accessor instead of dotted name to allow the @-symbol to be used.
end

NOTE: I do not know if you can use the lookupResult["name"] atm. I can’t find anything about it in the docs but the Graylog rule editor does not complain, so I guess it would work.

[blason]

OH thanks for reminding its as a extractor coverter.

[derPhlipsi (Philipp Ruland)]

Well, than you’ll have to create a second lookup table I’m afraid. Or have the Graylog dev know that the multi-value response of a lookup table is also useful as extractor converter. You could open up a Graylog Github Issue to get the devs to have a look at it

But I would reccomend you have a look at pipelines. AFAIK the extractors on inputs will be dropped as mid/long term change to Graylog (at least that is what I can remember to have read in some statements). But don’t quote me on that.

Greetings,
Philipp