Hi
If you want to create new meta based on field1=field2 then you will need a LUA parser to do this for you.
if you want to create a report, then use the reporting engine to create a list, and then use this list in another reporting rule.
As an example.
Create a List called Interesting User = {Alice,Bob,Charlie,David} in the reporting engine.
Then you could have a reporting rule where User in "List Interesting User"
NWDB Rule Syntax - RSA Security Analytics Documentation
| where <field1> [<field-operator>] <List1> | You can use a list in the where clause if you have multiple values to report on. For example, where ip.src exists && alias.host exists && alias.host contains $[User Reports/List of Alias Host]. When you use the list you must specify in the format $[<path>/<List name>]. |
