Issue with JSON Parse data

[rudra1]

Hi,

I have an array like below from which I need to get the value of , can you please help me in getting its value from the array

{"offense":{"last_persisted_time":{"value":1646797110000},"username_count":{"value":1},"description":{"value":"Uncategorized User Account Modification Creation Changes\n"},"rules(id)":{"value":100910},"rules(type)":{"value":"CRE_RULE"},"event_count":{"value":3},"flow_count":{"value":0},"assigned_to":{"value":"PR00001317-_Low_Priority-QROC@mssiam.sec.ibm.com"},"security_category_count":{"value":1},"follow_up":{"value":false},"rules_contributing_to_offense":{"value":"UC2-1 Uncategorized User Account Modification, Creation, Changes"}},"event":{"starttime":{"value":"1646796886860"},"protocolid":{"value":"255"},"sourceip":{"value":"xx.xxx.8x.x"},"logsourceid":{"value":"8103"},"qid":{"value":"44251582"},"sourceport":{"value":"0"},"eventcount":{"value":"1"},"magnitude":{"value":"5"},"identityip":{"value":"0.0.0.0"},"destinationip":{"value":"1xx.xxx.8x.x"},"destinationport":{"value":"0"},"category":{"value":"3007"},"username":{"value":"FSIIBQA01L"},"logsource":{"value":"LinuxServer @ ause1qiibvaq01"},"categoryname":{"value":"Privilege Escalation Succeeded"},"eventname":{"value":"Privilege Escalation Succeeded"},"eventdescription":{"value":"Privilege escalation was successful"},"protocol":{"value":"Reserved"}}}

Can anyone  please help me on this?

[Ankur Bawiskar]

Hi,

what have you tried?

Regards
Ankur

[Ankur Bawiskar · Accepted solution]

Hi,

your json string contains control character and hence parsing cannot be done

there is \n in the description; I removed it and then it worked

Enhance similar for other values

var jsonString = '{"offense":{"last_persisted_time":{"value":1646797110000},"username_count":{"value":1},"description":{"value":"Uncategorized User Account Modification Creation Changes"},"rules(id)":{"value":100910},"rules(type)":{"value":"CRE_RULE"},"event_count":{"value":3},"flow_count":{"value":0},"assigned_to":{"value":"PR00001317-_Low_Priority-QROC@mssiam.sec.ibm.com"},"security_category_count":{"value":1},"follow_up":{"value":false},"rules_contributing_to_offense":{"value":"UC2-1 Uncategorized User Account Modification, Creation, Changes"}},"event":{"starttime":{"value":"1646796886860"},"protocolid":{"value":"255"},"sourceip":{"value":"xx.xxx.8x.x"},"logsourceid":{"value":"8103"},"qid":{"value":"44251582"},"sourceport":{"value":"0"},"eventcount":{"value":"1"},"magnitude":{"value":"5"},"identityip":{"value":"0.0.0.0"},"destinationip":{"value":"1xx.xxx.8x.x"},"destinationport":{"value":"0"},"category":{"value":"3007"},"username":{"value":"FSIIBQA01L"},"logsource":{"value":"LinuxServer @ ause1qiibvaq01"},"categoryname":{"value":"Privilege Escalation Succeeded"},"eventname":{"value":"Privilege Escalation Succeeded"},"eventdescription":{"value":"Privilege escalation was successful"},"protocol":{"value":"Reserved"}}}';

var parser = JSON.parse(jsonString);

var sourceIP = parser.event.sourceip.value;
gs.info('Source IP:' + sourceIP);

Output:

Regards
Ankur

[rudra1]

Hi @Ankur Bawiskar , Thank you very much. it worked.

[Maik Skoddow]

Hi

load your JSON into https://jsonpathfinder.com/ and you can get the access paths via clicking on the elements

Kind regards
Maik