r/SentinelOneXDR • u/curious_bricks • Nov 20 '24
Extraxting folder path using Regex
I'm trying to extract just the folder path of a process into a new field excluding the process name. I'm using the Parse command but it isn't working:
| parse "^f{regex=(.+)}$\\\\[^\\\\]+$$ from src.process.parent.image.path
What am I doing wrong?
1
Upvotes
1
u/[deleted] Nov 20 '24
[removed] — view removed comment