IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  JSON expression | Office 365 DSM | QRADAR

    Posted Wed October 05, 2022 11:28 PM

    "OperationProperties":[{"Name":"RuleOperation","Value":"AddMailboxRule"},{"Name":"RuleId","Value":"0"},{"Name":"RuleState","Value":"Enabled"},{"Name":"RuleCondition","Value":"{(MessageRecipMe Equal True)}"},{"Name":"RuleName","Value":"die meinen Namen im Feld \"An\" oder \"Cc\" enthält"},{"Name":"RuleProvider","Value":"RuleOrganizer"},{"Name":"RuleActions","Value":"[{\"ActionType\":\"Forward\",\"Recipients\":[\"c.gieseke@gmail.com\"],\"ForwardFlags\":\"None\"}]"}],"

    required output: 
    ActionType : Forward
    Recipients : gieseke@gmail.com

    expression 

    {/"OperationProperties"[6]}

    Hello Community 

    Looking for assistance in creating json expression for the required output. Through examples i was able to extract common fields but not the above one with nested fields. 

    Appreciate your response  



    ------------------------------
    Vijay Reddy
    ------------------------------


  • 2.  RE: JSON expression | Office 365 DSM | QRADAR

    Posted Thu October 06, 2022 09:20 AM

    Hi Vijay,

    A JSON expression won't work for this particular case because the "RuleActions" property's Value contains partially escaped JSON (the quotes are escaped via backslash) so it is not valid JSON. You'll need to use a Regex expression in this case:

    For the ActionType value:
    ActionType\\":\\"([^\\]+)

    For the Recipients value:

    Recipients\\":\[\\"([^\\]+)

    Cheers
    Colin



    ------------------------------
    COLIN HAY
    IBM Security
    ------------------------------



  • 3.  RE: JSON expression | Office 365 DSM | QRADAR

    Posted Thu October 06, 2022 10:38 AM
    Thank you ! i did work

    ------------------------------
    Vijay Reddy
    ------------------------------