matchbehavior

Matches input records against a behavior profile using the key fields defined in the profile, and appends the value fields from matched behavior profile records to the output records.

Command properties

Syntax

In the syntax above, name is available starting with 4.0.2609.0.

Options

guid=STR

Behavior profile GUID. In the 5.0 series (through 5.0.2605.2), this is the only way to specify the target. In the 4.0 series (4.0.2609.0 and later), this option cannot be used together with name, and you must specify either guid or name.

name=STR

Behavior profile name (cannot be used together with guid). You must specify either the guid or name option. This option is available starting with 4.0.2609.0.

invert=BOOL

Inverts the match result. When set to t, outputs records that are not included in the behavior profile. (Default: f)

verify=BOOL

Whether to validate the behavior profile object. When set to f, skips validation of the behavior profile at parse time. (Default: t)

Output fields

On match success (invert=f):

On match failure (invert=t):

Error codes

Parse errors

Runtime errors

None

Description

The matchbehavior command compares input records against behavior profile data using the key field values defined in the behavior profile. If the key field value of an input record exists in the behavior profile, all value fields from the matched behavior profile record are merged into the input record and output.

Use the guid option to specify which behavior profile to match against. In the 4.0 series (4.0.2609.0 and later), you can also use the name option; the command looks up the profile by that name to resolve its GUID, and specifying both guid and name, or omitting both, causes an error, as does specifying a name that does not exist or that matches more than one profile.

When invert=t is specified, only records not found in the behavior profile are output. In this case, the value fields of the behavior profile are not appended.

When verify=f is specified, the behavior profile is not validated at parse time. The profile is loaded at execution time, which is useful when the profile is still being built.

Examples

1. Match records against a behavior profile

   json "[{'src_ip': '192.0.2.1'}, {'src_ip': '198.51.100.5'}]"
   | matchbehavior guid=550e8400-e29b-41d4-a716-446655440000
   

   Matches input records against the behavior profile with the specified GUID using its key fields, and appends the profile's value fields to matched records.

2. Filter out matched records

   json "[{'src_ip': '192.0.2.1'}, {'src_ip': '198.51.100.5'}]"
   | matchbehavior guid=550e8400-e29b-41d4-a716-446655440000 invert=t
   

   Outputs only records not included in the behavior profile.

3. Match without validation

   json "[{'src_ip': '192.0.2.1'}]"
   | matchbehavior guid=550e8400-e29b-41d4-a716-446655440000 verify=f
   

   Skips validation of the behavior profile's existence and performs matching. Useful when the profile is still being built.

4. Specifying a behavior profile by name (4.0 series, 4.0.2609.0 and later)

   table limit=1000 WEB_APACHE_SAMPLE
   | matchbehavior name=web_attacker_profile
   

   Matches using a behavior profile specified by name instead of GUID.

Change history