Hi all,
I was wondering how I can achieve the following use case in the current version of Metron? I want to have attributes in the Metron JSON object that are an array. For example, if a threat is impacting multiple users, they are all contained in an attribute (e.g. user_id:[id1, id2, id3]). Now if I want to enrich the event with data that requires the user_id as a key in enrichment stored in HBASE, how would I do this? Cheers, Ali
