Hi,
I need to capture the hostName information, but in the request for this json the hostName value is not always on the same line,
The only way I've found is to search for the hostName line by informing the desired line, in this case line 3
triggerBody()?['alert2']?['entities']?['entities'][3]
so creating rules to check if it has hostName:, if not, I set the variable to the next line and test the verification again, and so on until it finds hostName: in the variable
Json exemplo:
{
"entities": [
"fileName:c:\\windows\\regedit.exe",
"hostId:8868979671",
"hostName:REGLOST\\NT0547",
"hostNameAndHostId:REGLOST\\NT0547:887571",
"processImagePath:c:\\windows\\regedit.exe",
"processUsername:AUTORIDADE NT\\SISTEMA",
"programSha256:92f9f987a654x1658a7c4a0988ac918170",
"sensorHostId:889754571",
"sensorId:89873571",
"userName:AUTORIDADE NT\\SISTEMA"
],
"relationships": [
{
"from_entity": "hostName:REGLOST\\\\NT0547",
"relationship": "is",
"to_entity": "sensorHostId:88975471571"
}
]
}
Another test I performed was the Filter array
@contains(triggerBody()?['alert2']?['entities'], 'hostName')
However, I noticed that my Json result does not seem to be formatted correctly so that my filter contains
my filter 'hostName' contains doesn't work for my inputs
I would like to understand if with the Json input that I have, it is possible for me to filter a line with some porator saying that it may contain more letters as in PowerShell as -like "hostName*" using * as operator.
Would there be something in PowerAutomate that would do something like this? Or is there any other way that I don't need to get line by line if I have the desired information in my case?
Thanks.
