000035167 - Create the syntax to correctly define an JSON array Attribute path in RSA Web Threat Detection

Document created by RSA Customer Support Employee on Feb 22, 2018
Version 1Show Document
  • View in full screen mode

Article Content

Article Number000035167
Applies ToRSA Product Set: Web Threat Detection
RSA Product/Service Type: Mitigator
RSA Version/Condition: 5.x, 6.x

IssueTypical Customer question:  How can I define the 'name' of a JSON attribute in Silvercat to find an element of a JSON array?

Example request - A Customer desired to create an attribute from a JSON element, which has up to eight sets in an array, that would likely be used to trigger a rule.  
Tasks1. Obtain the Configuration file (universal_conf.py).
2. Make sure a JSON selector is configured in the universal_conf.py.
3. Obtain the sample JSON data and place in a JSON parser to verify valid formatting.
4. Create a sample of JSON  data to send through for testing. (This could be sent as a curl expression.)
5. Create the JSON Attribute and add the path statement to the 'name'.
6. Test by looking for the Attribute to appear in the Transaction viewer.  
ResolutionExample of the path syntax needed to define the selection of an array element

//element/item[n]/element name

  •  arrays are 0 based, so element set 0, 1, 2, etc.
  • "item" is a virtual object that defines the array and element in array that needs to be selected

Given an example JSON array:  

To select the MiddleInitial of the 3rd element of the array, you would create the name syntax as follows: 


That should return the element 'J' if created correctly.