Unable to parse the JSON data

[rudra1]

Hi All,

Unable to parse the JSON data  which i am getting like as below: i want to map the highlighted ones. Please advice.

{
  "Incident" : {
    "properties(description)" : {
      "value" : "Service Account, Logic Monitor made an attempt to run commands remotely on ******S002 from *****789, using 1 PowerShell command. "
    },
    "properties(owner(userPrincipalName))" : {
      "value" : "example 123"
    },
    "properties(title)" : {
      "value" : "Remote code execution attempt"
    },

},

"HostEntity" : {
    "properties(hostName)" : {
      "value" : "8888S002, 9999S001"
    },
    "properties(additionalData(ShouldResolveIp))" : {
      "value" : "False, False, False, False, False"
    }

},

[Ankur Bawiskar]

So what script did you start and where are you stuck?

[rudra1]

I have storing the string data in variable str.

var str = 

{"Incident" : {"properties(description)" : {"value" : "Service Account, Logic Monitor made an attempt to run commands remotely on ******S002 from *****789, using 1 PowerShell command. "
    },
    "properties(owner(userPrincipalName))" : {
      "value" : "example 123"
    },
    "properties(title)" : {
      "value" : "Remote code execution attempt"
    },

},

"HostEntity" : {
    "properties(hostName)" : {
      "value" : "8888S002, 9999S001"
    },
    "properties(additionalData(ShouldResolveIp))" : {
      "value" : "False, False, False, False, False"
    }

},

var obj =JSON.parse(str);
gs.print(JSON.stringify(obj.Incident));
var str2 = obj.Incident;
gs.print(JSON.stringify(str2.properties(description))); ------------->printing the value as Undefined

[Mahendra RC]

Hello Rudra,

Please check with below code once in your background script. I believe you are storing your data as JSON object only and no need to parse that:

(function () {
var str = {
	"Incident": {
		"properties(description)": {
			"value": "Service Account, Logic Monitor made an attempt to run commands remotely on ****, using 1 PowerShell command. "
		},
		"properties(owner(userPrincipalName))": {
			"value": ""
		},
		"properties(title)": {
			"value": "Remote code execution attempt"
		},
		"properties(owner(email))": {
			"value": ""
		},
		"properties(owner(assignedTo))": {
			"value": ""
		},
		"type": {
			"value": "Example123"
		},
		"properties(additionalData(bookmarksCount))": {
			"value": 0
		},
		"properties(incidentUrl)": {
			"value": "TestURL"
		},
		"properties(status)": {
			"value": "New"
		},
		"properties(lastModifiedTimeUtc)": {
			"value": "2022-**-** 05:46:54 UTC"
		},
		"properties(firstActivityTimeUtc)": {
			"value": "2022-**-** 15:30:27 UTC"
		},
		"properties(additionalData(alertsCount))": {
			"value": 1
		},
		"properties(additionalData(alertProductNames))": {
			"value": "Test 9876"
		},
		"properties(createdTimeUtc)": {
			"value": "2022-00-00 15:38:01 UTC"
		},
		"name": {
			"value": "*****-****-***-***-******"
		},
		"properties(severity)": {
			"value": "Medium"
		},
		"properties(additionalData(commentsCount))": {
			"value": 0
		},
		"properties(owner(objectId))": {
			"value": ""
		},
		"etag": {
			"value": "\"0000000000\""
		},
		"properties(lastActivityTimeUtc)": {
			"value": "2022-00-00 15:38:01 UTC"
		},
		"properties(incidentNumber)": {
			"value": 39
		},
		"properties(additionalData(tactics))": {
			"value": "Execution"
		},
		"properties(relatedAnalyticRuleIds)": {
			"value": "********"
		},
		"id": {
			"value": "Test Related Analytics"
		}
	},
	"HostEntity": {
		"properties(hostName)": {
			"value": "EUTest**, EUE***000"
		},
		"properties(additionalData(ShouldResolveIp))": {
			"value": "False, False, False, False, False"
		},
		"kind": {
			"value": "Test"
		},
		"properties(dnsDomain)": {
			"value": "Test Domain"
		},
		"properties(friendlyName)": {
			"value": "EUTest**, EUE***000"
		},
		"name": {
			"value": "7478"
		},
		"id": {
			"value": "478"
		},
		"type": {
			"value": "Test Value"
		}
	}
};
var IncidentData = str["Incident"]; // You get the Incident data
var HostData = str["HostEntity"];
gs.print(JSON.stringify(IncidentData));
gs.print(JSON.stringify(HostData));

var Description = IncidentData["properties(description)"]; // you get the properties(description) data
var PrincipalName = IncidentData["properties(owner(userPrincipalName))"];
gs.print(JSON.stringify(Description));
gs.print(JSON.stringify(PrincipalName));

var HostName = HostData["properties(hostName)"]; // you get the properties(description) data
var PrincipalName = HostData["properties(additionalData(ShouldResolveIp))"];
gs.print(JSON.stringify(HostName));
gs.print(JSON.stringify(PrincipalName));

})();

Please mark my respsone as helpful/correct, if it answer your question.

Thanks

[Mahendra RC]

Hello Rudra,

Just wanted to check with you, if the my above response answered your question. If yes, then please do close this thread/question by marking the appropriate response as correct.

If you still need any further help or guidance on this then please update those on this question.

Thanks