ESA - Wildcard in String Array

[JoeGumke]

We have a need to look for wildcard matches in a string array within an ESA correlation alert.

I can get the string value to match using the syntax below, but need to get a wildcard match as we need to see matches of domains that match prior to this value.

Syntax for static match of 'maliciousdomain'. Need to get a wildcard to match anything before 'maliciousDomain'.

        @Description('')
        @RSAAlert(oneInSeconds=0)

        SELECT * FROM Event(
            medium = 1
            AND ('maliciousDomain' = ALL( alias_host )));

[LeeKirkpatrick]

Hey Joseph,

The  ESA is treating alias_host as a vector, the lambda expression I gave you is for arrays and why it did not work, my apologies.

The best method I can think of right now is casting the vector into a string and performing a contains operation against it:-

SELECT *, cast(alias_host, string) as Hostname FROM Event(

cast(alias_host, string).toLowerCase().contains('maliciousdomain.com'))

Cheers,

Lee

[JoeGumke]

thanks lee ! works like a charm!