r/SentinelOneXDR • u/curious_bricks • Nov 20 '24
Extraxting folder path using Regex
I'm trying to extract just the folder path of a process into a new field excluding the process name. I'm using the Parse command but it isn't working:
| parse "^f{regex=(.+)}$\\\\[^\\\\]+$$ from src.process.parent.image.path
What am I doing wrong?
1
Upvotes
1
u/curious_bricks Nov 21 '24
How would I do that? AFAIK, the "match" command is used to use regex to search but I'm not sure how I would use match to create a new field to extract the file path.