Split protocol and alert info from ALERT_JSON: new PROTOCOL_INFO_JSON column

This commit is contained in:
Alfredo Cardigliano 2024-12-05 15:13:16 +01:00
parent 828af618d6
commit ae5128c620
9 changed files with 79 additions and 63 deletions

View file

@ -1470,10 +1470,10 @@ function format_confidence_from_json(record)
local alert_json = {}
local confidence = nil
if record["ALERT_JSON"] then
alert_json = json.decode(record["ALERT_JSON"])
elseif record["json"] then
alert_json = json.decode(record["json"])
if record["PROTOCOL_INFO_JSON"] then
alert_json = json.decode(record["PROTOCOL_INFO_JSON"])
elseif record["protocol_info_json"] then
alert_json = json.decode(record["protocol_info_json"])
end
if (alert_json) and (alert_json.proto) and (alert_json.proto.confidence) and