Original Message:
Sent: Thu October 06, 2022 09:19 AM
From: COLIN HAY
Subject: JSON expression | Office 365 DSM | QRADAR
Hi Vijay,
A JSON expression won't work for this particular case because the "RuleActions" property's Value contains partially escaped JSON (the quotes are escaped via backslash) so it is not valid JSON. You'll need to use a Regex expression in this case:
For the ActionType value:
ActionType\\":\\"([^\\]+)
For the Recipients value:
Recipients\\":\[\\"([^\\]+)
Cheers
Colin
------------------------------
COLIN HAY
IBM Security
Original Message:
Sent: Wed October 05, 2022 11:28 PM
From: Vijay Reddy
Subject: JSON expression | Office 365 DSM | QRADAR
"OperationProperties":[{"Name":"RuleOperation","Value":"AddMailboxRule"},{"Name":"RuleId","Value":"0"},{"Name":"RuleState","Value":"Enabled"},{"Name":"RuleCondition","Value":"{(MessageRecipMe Equal True)}"},{"Name":"RuleName","Value":"die meinen Namen im Feld \"An\" oder \"Cc\" enthält"},{"Name":"RuleProvider","Value":"RuleOrganizer"},{"Name":"RuleActions","Value":"[{\"ActionType\":\"Forward\",\"Recipients\":[\"c.gieseke@gmail.com\"],\"ForwardFlags\":\"None\"}]"}],"
required output:
ActionType : Forward
Recipients : gieseke@gmail.com
expression
{/"OperationProperties"[6]}
Hello Community
Looking for assistance in creating json expression for the required output. Through examples i was able to extract common fields but not the above one with nested fields.
Appreciate your response
------------------------------
Vijay Reddy
------------------------------