Content criteria tool#
You can create entity rules that conditionally match entities using content criteria.
To get started with content criteria for entity rules:
Create or edit an entity rule.
In the Criteria selection section, select + Criteria.
From the drop-down menu, select Content criteria
This brings up the complex content criteria tool.
Complex content criteria tool#
The complex content criteria tool allows you to add conditional content-based matches to your entity rules.
The Content criteria must evaluate to “true” to generate a match for the entity rule.
You can only have one Content criteria per entity rule.
Conditions are evaluated as “true” or “false”.
Groups are AND or OR groups of conditions.
AND groups must have all conditions for the group to evaluate to “true”.
OR groups just need one condition to be “true” for the group to evaluate to “true”.
Field name |
Description |
---|---|
Path* |
JSON path for an entity’s field to evaluate. Note Known issue: In 2.13.0 and earlier, predefined items in this drop-down list may not work. Instead, manually enter JSON paths for your content criteria. |
MATCHES/DOESN’T MATCH |
|
Value* |
Enter a value to evaluate. |
![Groups of conditions.](../../../../_images/content-criteria-02.png)
JSON paths in content criteria#
You can specify entity attributes in a simplified JSON path syntax. When typing JSON paths manually here:
Omit
data
when accessing members of thedata
field. For example, to access thedata.title
field, enter onlytitle
.To access all other fields, use
raw
, followed by the path to the field. For example, to access thetlp_color
field in an entity, enter:raw.meta.tlp_color
omit
[]
characters when manually entering paths.
You can also select one or more of the following predefined paths:
Pre-defined path |
JSON path |
Entity type |
---|---|---|
Information source, Identity |
|
All |
Information source, References |
|
All |
Title |
|
All |
Affected assets, Properties affected |
|
Incident |
Observables |
|
Indicator |
Sightings |
|
Indicator |
Raw events |
|
Sightings |
Security control, Identity |
|
Sightings |
Security control, References |
|
Sightings |
Resources, Infrastructure |
|
TTP |
Resources, Persona |
|
TTP |
Tip
Examples using raw
raw. prefix |
Custom root field |
Targeted entity data |
---|---|---|
|
tags |
Enables accessing entity tag field values through searching, filtering, and rules. |
|
extracts.kind |
Enables accessing observable type field values through searching, filtering, and rules. |
Tip
You can select one or more predefined JSON paths from the available options, or you can enter custom, user-defined JSON paths by typing them in the input field.
If you manually type user-defined JSON paths, they must be valid JSON paths pointing to existing fields in the entity JSON structure.
If you enter invalid JSON paths or valid JSON paths pointing to non-existing fields, they are silently ignored.
Tip
To examine the JSON data structure of an entity:
Open the entity detail pane and click the JSON tab.
Alternatively:
Value
The regex syntax this field accepts is the Elasticsearch regular expression syntax.
The main peculiarities of the Elasticsearch DSL query syntax are:
Anchors –
^
and$
– are implied at the beginning and at the end of the regex.Do not include them in the regex pattern input.
If you insert explicit anchor characters in the value input field, they are interpreted as literal values.
Escape special characters:
( . ? + | { } [ ] ( ) " \ / )
To escape a special character, prepend a backslash
\
to it.Example:
\{ \}
Note
At the moment, Elasticsearch regular expression syntax optional operators are not supported.
Note
Although the regex syntax used in the UI of the Intelligence Center is that of ElasticSearch, the regex syntax used by EclecticIQ Intelligence Center’s ingestion engine is Python regex. In the vast majority of cases this does not lead to conflicts, but if your discovery rule is not working the way you want it to, this may be the reason.
Here are two differences that commonly cause problems:
ElasticSearch searches for whole strings, while Python searches everywhere in a string. For example,
Input: Cert-BUND
Pattern: ert
ES result:
Python: will match
ElasticSearch regex syntax requires you to leave out anchors, whereas Python regex syntax requires you to include them.
If you are experiencing problems in this area, contact Customer Support for help in writing the discovery rule you want.