brexhq / substation

Substation is a toolkit for routing, normalizing, and enriching security event and audit logs.
https://substation.readme.io
MIT License
322 stars 16 forks source link

feat: Allow Multiple URL Interpolations in the HTTP Processor #124

Closed jshlbrd closed 1 year ago

jshlbrd commented 1 year ago

Description

Motivation and Context

Discovered this while working with an enrichment service that has its own search language, there are some scenarios where it's helpful to interpolate the same value multiple times. For example: url:"hxxps://foo.com/?query=( a:"${data}" AND b:"*${data}" ). Since this goes from supporting a single interpolation to many interpolations this should be non-breaking.

Also, this doesn't add support for interpolating multiple values, just interpolating the same value multiple times. Multi-value interpolation would have bigger impact but could be possible.

How Has This Been Tested?

Integration tested locally and in production data pipelines.

Types of changes

Checklist: