Given an input string and a list of patterns, find which pattern best matches the input string and the confidence of the match.
- Click + on the parent node.
- Enter the Pattern Lookup operator in the search field and select the operator from the Results to open the operator form.
- In the Event Table drop-down, enter or select the name of the table.
- In the Message Column, enter the column name in an eventTable to match the patterns.
- In the Pattern Table drop-down, enter or select the table that contains patterns for lookup.
- In the Pattern Column drop-down, enter or select the name of the column that contains patterns in a patternTable.
- In the Marker Column drop-down, enter or select the column name that contains markers in a patternTable.
- In the Name Column drop-down, enter or select a column name that contains 'name' in a patternTable.
- In the Pattern Type Column drop-down, enter or select a column name that contains 'patternType' in a patternTable.
- In the Threshold field, enter a threshold value.
- Click Run to view the result.
- Click Save to add the operator to the playbook.
- Click Cancel to discard the operator form.
patternLookup(eventTable, column, patternTable, patternCol, markerCol, nameCol, patternTypeCol)
*eventTable: Event table.
column: Column name in an event table to lookup similar patterns from
patternTable: Table containing patterns.
patternCol: Column that contains the pattern
markerCol: Column that contains the custom marker (symbol) that is used in the pattern, if the pattern has a custom regex.
nameCol: Column that has the name for the pattern
patternTypeCol: Column that has the type of the pattern.
The event table with two additional columns:
|1||Windows shut down due to thermal event|
|1||Emil logged in to the server|
patternTable(id, pattern, marker, name, patternType)
|1||$any$ shut down due to thermal event||$|
|1||Kumar logged in to the server|
patternLookup(eventTable, "col1", patternTable, "pattern", "marker", "name", "patternType")
|1||Windows was shut down due to thermal event||$any$ shut down due to thermal event||1.0|
|1||Emil logged in to the server||Kumar logged in to the server||0.83|
Updated 10 months ago