Create the syntax to correctly define an JSON array Attribute path in RSA Web Threat Detection
3 years ago
Originally Published: 2017-05-16
Article Number
000067709
Applies To
RSA Product Set: Web Threat Detection
RSA Product/Service Type: Mitigator
RSA Version/Condition: 5.x, 6.x

 
Issue
Typical Customer question:  How can I define the 'name' of a JSON attribute in Silvercat to find an element of a JSON array?

Example request - A Customer desired to create an attribute from a JSON element, which has up to eight sets in an array, that would likely be used to trigger a rule.  
Tasks
1. Obtain the Configuration file (universal_conf.py).
2. Make sure a JSON selector is configured in the universal_conf.py.
3. Obtain the sample JSON data and place in a JSON parser to verify valid formatting.
4. Create a sample of JSON  data to send through for testing. (This could be sent as a curl expression.)
5. Create the JSON Attribute and add the path statement to the 'name'.
6. Test by looking for the Attribute to appear in the Transaction viewer.  
Resolution
Example of the path syntax needed to define the selection of an array element

//element/item[n]/element name

Note:
  •  arrays are 0 based, so element set 0, 1, 2, etc.
  • "item" is a virtual object that defines the array and element in array that needs to be selected

Given an example JSON array:  
{"CommonData":{"AppName":"MYAPP"},"AccountNumber":"abcdefgh012","AuthorizedUser":[{"LastName":"Smith","FirstName":"Andrew","MiddleInitial":"D","NameSuffix":""},{"LastName":"Jones","FirstName":"Samuel","MiddleInitial":"A","NameSuffix":""},{"LastName":"Truman","FirstName":"Donald","MiddleInitial":"J","NameSuffix":"Jr"}],"switch":"on"}    

To select the MiddleInitial of the 3rd element of the array, you would create the name syntax as follows: 

//AuthorizedUser/item[2]/MiddleInitial

That should return the element 'J' if created correctly.

Related Articles

Trending Articles

Don't see what you're looking for?