Evaluation Process Plugin
New Feature
In-line filtering
The eval function now accepts an optional filter parameter for Conditional and Comparison functions. When supplied, eval returns only the event logs for which the expression is true.
Previously, filtering on a boolean expression required a separate filter step:
| process eval("result = value > 5") | filter result = true
You can now achieve the same result in a single step:
| process eval("result = value > 5", "filter")
Both queries return only the event logs where value is greater than 5
Enhancement
Eval Process Plugin now supports short-circuit evaluation for logical expressions:
For OR (||), evaluation stops as soon as an operand is true.
For AND (&&), evaluation stops as soon as an operand is false.
This reduces CPU usage and improves performance for large, nested detection expressions.
Bug Fix
When using the has_any command to check if a field contained specific strings, the command returned false even when matches existed, preventing users from performing reliable data analysis.
Vulnerability Fix
| Package | CVEs | Description |
|---|---|---|
spath |
Pending |
XXE injection vulnerability in the |
Past Releases
Evaluation Process Plugin v5.3.0 ▾
Bug Fixes
Evaluation Process Plugin v5.2.0 ▾
Enhancements
Updated the operator’s order used to evaluate the expressions:
- Arithmetic (x and ÷)
- Arithmetic (+ and-)
- Comparator
- Logical
Evaluation Process Plugin v5.1.0 ▾
Enhancement
Added the following functions:
- has_any to check the presence of a string or its substring in any list. Go to has_any to learn more.
- toint takes an argument of a string, long or double type and converts its value to an integer. Go to toint to learn more.
- toreal takes an argument of string or long type and converts its value to double. Go to toreal to learn more.
- issubstr to check if a string is a substring of another string. Go to issubstr to learn more.
- mimedecode to decode the Multipurpose Internet Mail Extensions (MIME) encoded values. Go to mimedecode to learn more.
- uuid to generate a random Universal Unique Identifier (UUID) for a log. Go to uuid to learn more.
Bug Fixes
Evaluation Process Plugin v5.0.0 ▾
Enhancements
New support for:
- The time duration of more than 86400 seconds (24 hours). For instance, 4 days 05:06:40.000
(hh:mm:ss.SSSS). - Conversion of hex values starting with 0x to decimal.
- Long data types.
Comments
Article is closed for comments.