Devo SOAR - columnsToJson

Given multiple columns, create a single JSON column from them.

Operator Usage in Easy Mode

1. Click + on the parent node.
2. Enter Columns to Json operator in the search field and select the operator from the Results to open the operator form.
3. In the Input Table drop-down, enter or select the table containing the data to run this operator on.
4. In the List of Columns drop-down, enter or select the list of columns to create a JSON column. You can add multiple columns using comma-separated values.
5. Click Run to view the result.
6. Click Save to add the operator to the playbook.
7. Click Cancel to discard the operator form.

Usage Details

LQL Command

columnsToJson(table, columns)

table: Table name
columns: Comma-separated list of columns, such as "col1, col2, col3"

Example

Input
table: field1, field2, field3

With "field1, field2, field3" as arguments, this operator creates lhub_json_column column with a JSON object in it.

You can extract the values using the query get_json_object(lhub_json_column, '$.field1') in LQL.

LQL command

columnsToJson(table, "sourceIP, sourcePort")

Output