Looking for advice on filtering an already filtered array

[mikraphne]

So, I am attempting to pull in some data from a Microsoft Sentinel Incident, and the main thing I am hoping to grab is a filepath and filename for files that are triggering a security incident. It wasn't too bad to filter down the entities of the incident (which normally includes, file hashes / IPs / URLs / Account names / Files - basically anything that was involved in the incident).

So, I have it down to showing me just the files in the incident. However, there are certain files that I don't care to have in the list, but Sentinel is overly detailed and throws everything in there, regardless.

For example:

{
    "body": [
        {
            "id": "fileID",
            "type": "Microsoft.SecurityInsights/Entities",
            "kind": "File",
            "properties": {
                "directory": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application",
                "fileName": "msedge.exe",
                "friendlyName": "msedge.exe"
            }
        },
        {
            "id": "fileID",
            "name": "1a9fc827-fcf7-bfa3-d4e6-62e61b4fb325",
            "type": "Microsoft.SecurityInsights/Entities",
            "kind": "File",
            "properties": {
                "directory": "C:\\Users\\username\\OneDrive\\Desktop\\Reference",
                "fileName": "5-Dysfunctions-of-a-Team-1-1.png",
                "friendlyName": "5-Dysfunctions-of-a-Team-1-1.png"
            }
        }
    ]
}

I already know that 'msedge.exe' is the browser that was used. so I don't care to send that to a malware sandbox. However, this '5-Dysfunction-of-a-Team-1-1.png' is the actual file that caused the alert (this was a false positive, but Sentinel had flagged it for ransomware.. weird, I know). I am hoping to see what my best options would be for this? I could filter out msedge.exe with a condition, but I already know there will be quite a few other legitimate executables that I want to ignore, like outlook.exe or word.exe and just set it up to grab the main (99% of the time, these files are not the cause of the alert, but happened to be the source of where the file was created, hence why Sentinel lists it, but I don't care to run it through a sandbox just to be told that it is Edge / Outlook / Word).

I was hoping to basically build a list of files that I don't ever care to list in the array, but was hoping to make it something that was easy to update and maintain in the case that someone else had to add a file to it. Then just have the filter ignore those entries if possible, but I am not totally sure how to go about doing this.

Right now, my Filter is taking the Parsed JSON data from the incident itself, then going into the file and searching for 'relatedEntities' with the kind = to 'File'.

Here is how I am creating that From value, which seems to be working fine, but I figured I would put it here in case someone else had a better idea on how to jump straight to what I need, minus the couple of .exe files that I want to exclude:

body('Parse_JSON_2')?['body']?['object']?['properties']?['relatedEntities']

Sorry, I know this post is a bit wordy. I am just insanely experiences with PowerAutomate and am not sure how to explain what I need without going into extra detail 🙂

[v-yueyun-msft]

Hi , @mikraphne 

According to your description, do you mean you want to filter the [kind] = "File" and [fileName]<> "msedge.exe".

And the result for your sample json is like this:

You can refer to this:

outputs('Compose')?['body']
@and( equals(item()?['kind'], 'File') , not(equals(item()?['properties']?['fileName'], 'msedge.exe')))

If this reply can help you , you can click mark this reply as solution (Accept solution) which can help more people, thanks in advance! 

Best Regards,

Yueyun Zhang

[mikraphne]

@v-yueyun-msft Close. I am hoping to have it create a new array without msedge.exe or outlook.exe or word.exe (for example). Basically, there are some files that I don't want to have in the array with other files. I was looking at setting up a filter for msedge.exe, but then I feel like I will need a filter for every file that I want to remove out of the array, which might lead to just a ton of 'filter arrays'. I figured there might be a cleaner approach to this instead of having all the extra filters.

[v-yueyun-msft · Accepted solution]

Hi , @mikraphne 

Do you mean you want to create an array like this :

[

  "msedge.exe",

  "outlook.exe"

]

And you need to loop this array and exclude this fileName from your array?

@and( equals(item()?['kind'], 'File') , not(equals(item()?['properties']?['fileName'], items('Apply_to_each') )))

If this reply can help you , you can click mark this reply as solution (Accept solution) which can help more people, thanks in advance! 

Best Regards,

Yueyun Zhang

[mikraphne]

@v-yueyun-msft Thanks so much! I kind of figured there was a cleaner looking way to do this, and that worked like a charm!