AnsweredAssumed Answered

Comparing two different types of meta in ESA Rule

Question asked by Maxim Marchenko on Dec 28, 2020
Latest reply on Dec 29, 2020 by Maxim Marchenko

Hello.

 

It may be a stupid question but I'm not a programmer.

 

So, how can I compare two different types of meta in ESA Rule(EPL) statement.

 

I need to compare string with string[]

user_dst which is string and host_src which is string[];

 

like this: user_dst != host_src (don't ask me why - due to Windows logs parsing things).

 

I understand that somehow I have to make string to be string[](or vice versa) to compare them.

Outcomes