Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Add Object Interpretation to Capture Named Groups #78

Merged
merged 1 commit into from
Feb 13, 2023

Conversation

jshlbrd
Copy link
Collaborator

@jshlbrd jshlbrd commented Feb 13, 2023

Description

  • Adds named group support to object interpretation in the Capture processor

Motivation and Context

Okta's audit logs contain unusual pseudo-JSON like this ...

{
	"debugContext": {
		"debugData": {
			"behaviors": "{New Geo-Location=NEGATIVE, New Device=NEGATIVE, New IP=NEGATIVE, New State=NEGATIVE, New Country=NEGATIVE, Velocity=NEGATIVE, New City=NEGATIVE}"
		}
	}
}

... that would be much better if it were like this instead:

{
	"debugContext": {
		"debugData": {
			"behaviors": {
				"New Geo-Location": "NEGATIVE",
				"New Device": "NEGATIVE",
				"New IP": "NEGATIVE",
				"New State": "NEGATIVE",
				"New Country": "NEGATIVE",
				"Velocity": "NEGATIVE",
				"New City": "NEGATIVE"
			}
		}
	}
}

This PR makes that possible by nesting captured fields under the set_key configuration.

How Has This Been Tested?

Added new unit testing.

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

  • My code follows the code style of this project.
  • My change requires a change to the documentation.
  • I have updated the documentation accordingly.

@jshlbrd jshlbrd marked this pull request as ready for review February 13, 2023 20:38
@jshlbrd jshlbrd requested a review from a team as a code owner February 13, 2023 20:38
@jshlbrd jshlbrd merged commit d5f687c into main Feb 13, 2023
@jshlbrd jshlbrd deleted the jshlbrd/feat/capture-groups branch February 13, 2023 21:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants