Record Modifier filter: is it possible to add a field with a value with spaces?

[canob]

Hi all,

A question about Record Modifier filter: is it possible to add a field with a value with spaces?
For example, like this:

[FILTER]
    Name record_modifier
    Match dns_detections_cobalt_strike_beacon
    Record mitre_id T1071.004
    Record mitre_id_desc Application Layer Protocol DNS

I tried with the value of the field between ' ' and " " too but is not working.

Thanks in advance for your help.

[patrick-stephens]

I can't see any spaces in your values...

    Record mitre_id T1071.004
    Record mitre_id_desc Application_Layer_Protocol_DNS

The key is mitre_id and the value is T1071.004.
The key is mitre_id_desc and the value is Application_Layer_Protocol_DNS.

[canob]

Hi @patrick-stephens
Yes, sorry, I completed the post by mistake with the filter that is actually working.
The filter that is not working is:

[FILTER]
    Name record_modifier
    Match dns_detections_cobalt_strike_beacon
    Record mitre_id T1071.004
    Record mitre_id_desc Application Layer Protocol DNS

mitre_id_desc is not being added as a field to the record.
I edited my original post too, to clarify.
Thanks

[patrick-stephens]

I'd probably just do a LUA script to be honest, if it doesn't work with spaces.

[anasnaguib]

You can use Modify filter with Set

[FILTER]
    Name modify
    Match dns_detections_cobalt_strike_beacon
    Set mitre_id T1071.004

[canob]

Hi @anasnaguib ,
But can you set field content with spaces, for example for mitre_id, use "T1071 004"?

[anasnaguib]

Just tested No spaces would not work with it, you can use _ to separate words or use lua Filter Configuration ``` [FILTER] Name lua Match * Script add_record.lua Call add_record_function ``` Lua Code ``` function add_record_function(tag, timestamp, record) -- Check if the nested keys exist record["custome_record"] = "Any text you need :)" return 1, timestamp, record end ``` Hope this will help.

…

On Tue, Aug 20, 2024 at 10:48 PM Alejandro Guida ***@***.***> wrote: Hi @anasnaguib <https://github.com/anasnaguib> , But can you set field content with spaces, for example for mitre_id, use "T1071 004"? — Reply to this email directly, view it on GitHub <#7875 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA464TGIXEF5SF64YSB5VVDZSPBVLAVCNFSM6AAAAABM2Y7IMCVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTANBQGA4TGNQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>