How to avoid parsing fields = '0'?

I just came to recommend the same.  :)-------------------------------------------
Original Message:
Sent: Jan 26, 2022 09:42 AM
From: Ken Mickeletto
Subject: How to avoid parsing fields = '0'?

Hi Tony,

The best way to handle this is to capture the field into a temporary variable and then only set it to a permanent variable if the value is a desired value.

<eventFormatRecognizer><![CDATA[\[Falcon-data-replicator\]]]></eventFormatRecognizer><parsingInstructions> <collectFieldsByRegex src="$_rawmsg">  <regex><![CDATA[\[Falcon-data-replicator\]\s+\[<phCustId:gPatInt>\]\s+\[<relayDevName:gPatMesgBodyMin>\]:<_body:gPatMesgBody>]]></regex> </collectFieldsByRegex> <setEventAttribute attr="eventType">Crowdstrike-FDR-Generic</setEventAttribute> <collectAndSetAttrByJSON src="$_body">  <attrKeyMap attr="_evtType" key="ExternalApiType"/>  <attrKeyMap attr="_allocateVirtualMemoryCount" key="AllocateVirtualMemoryCount"/> </collectAndSetAttrByJSON> <when test="$_allocateVirtualMemoryCount != '0'">  <setEventAttribute attr="allocateVirtualMemoryCount">$_allocateVirtualMemoryCount</setEventAttribute> </when>

Note the underscore on the variable name.  This is a temp variable and we only store it into the real allocateVirtualMemoryCount variable if it does not equal 0.

I hope this helps!

------------------------------
Ken
------------------------------

Original Message:
Sent: Jan 25, 2022 06:07 AM
From: Tony C
Subject: How to avoid parsing fields = '0'?

Hello there,

We are getting events from Crowdstrike into FortiSIEM and no many fields are been parsed. I am working in adding the additional fields but I would like to hide when fields ='0'.
Because so many fields are coming over it doesn't make sense to show all of them, I want to show only the fields who are different to 0.


This is an example of Crowdstrike parser:

<eventFormatRecognizer><![CDATA[\[Falcon-data-replicator\]]]></eventFormatRecognizer>
<parsingInstructions>
<collectFieldsByRegex src="$_rawmsg">
<regex><![CDATA[\[Falcon-data-replicator\]\s+\[<phCustId:gPatInt>\]\s+\[<relayDevName:gPatMesgBodyMin>\]:<_body:gPatMesgBody>]]></regex>
</collectFieldsByRegex>
<setEventAttribute attr="eventType">Crowdstrike-FDR-Generic</setEventAttribute>
<collectAndSetAttrByJSON src="$_body">
<attrKeyMap attr="_evtType" key="ExternalApiType"/>
<attrKeyMap attr="allocateVirtualMemoryCount" key="AllocateVirtualMemoryCount"/>
</collectAndSetAttrByJSON>



Sample raw log event I want to parse:
2022-01-24 15:30:26 [Falcon-data-replicator] [1] [sqs.us-west-2.amazonaws.com]:{"AllocateVirtualMemoryCount":"0","ArchiveFileWrittenCount":"0","

On this case if I do not want to see the "allocateVirtualMemoryCount" field under Event details because it is = 0 how could I do it within the parser?

Thanks in advance.