CRTX-146131-Microsoft-Defender-for-Cloud #38537
Conversation
|
@sdaniel6 Doc review completed. |
| @@ -175,27 +187,24 @@ filter _collector_type = "Azure Event Hub" | |||
| xdm.database.statement = coalesce(ExtendedProperties_Top_anomalous_queries, ExtendedProperties_Top_suspicious_queries), | |||
| xdm.target.url = ExtendedProperties_URL, | |||
| xdm.source.user_agent = ExtendedProperties_User_Agent, | |||
| xdm.network.ip_protocol = arrayindex(regextract(ExtendedProperties_Known_Port,"^\S+"),0), | |||
There was a problem hiding this comment.
I'm assuming this regex refers to a field that looks like: HTTP:80, based on the fact that target port searches for \d+ on the same field. In this case this regex will include the port number and not only the protocol. Am I correct?
There was a problem hiding this comment.
The values in the original "Known Port" field follow the format "protocol (port)", such as "HTTP (80)" or "HTTPS (443)". Since there is a space between the protocol and the port, using "^\S+" will only capture the protocol.
I agree that the current regex looks too simple, so I will improve it by using capture groups to correctly extract both the protocol and the port.
New regex for protocol - "^(\w+)\s*\(\d+\)$"
New regex for port - "\((\d+)\)$"
Thanks,
Saar.
sdaniel6
requested review from
OBavly
and removed request for
ShirleyDenkberg
sdaniel6
added
the
bypass.url
Status
Related Issues
fixes: https://jira-dc.paloaltonetworks.com/browse/CRTX-146131
Description
Improved implementation of Cortex Data Model (XDM) mapping for Azure Defender For IOT.
Must have