window.least_common_strings

Supported in:

Rules Search

window.least_common_strings(string_val, how_many_to_return)

Description

Returns a specified number of least commonly occurring string elements in the input array.

Param data types

STRING, INT

Return type

ARRAY_STRINGS

Code samples

Example 1

This example shows the two least common hostnames in five minutes.

// This rule creates a detection when the least common hostname in 5 minutes for a user matches.
events:
 $e.user.userid = $userid
match:
 $userid over 5m
outcome:
  $p1 = window.least_common_strings($e.principal.hostname, 1) // yields ["banana"] if the event hostname values in the match window are ["apple", "apple", "pear", "pear", "pear", "banana"].
condition:
  $e and arrays.contains($p1, "banana")

Example 2

This example shows that the number of values to return is more than the number of distinct values.

events:
 $e.user.userid = $userid
match:
 $userid over 5m
outcome:
  $p1 = window.least_common_strings($e.principal.hostname, 100) // yields ["banana", "apple", "pear"] if the event hostname values in the match window are ["apple", "apple", "pear", "pear", "pear", "banana"].
condition:
  $e and arrays.contains($p1, "banana")

Example 3

This example shows that default zero-values are ignored.

events:
 $e.user.userid = $userid
match:
 $userid over 5m
outcome:
  $p1 = window.least_common_strings($e.principal.hostname, 1) // yields [""] if the event hostname values in the match window are ["", "banana"].
condition:
  $e and arrays.contains($p1, "banana")