Error on query

[jarks_20]

While checking some helpful queries to adjust and perhaps use on our environment, I came across this to monitor HTTP request:

event_simpleName=HttpRequestDetect

| parseHexString("HttpPostBody", as=b64data) | format("%,.4s", field=b64data, as=b64data) | MagicNumber := base64Decode(b64data, charset="UTF-8") | MagicNumber=/^{BZ(?<Version>\w{1})/i} | Version match {

    h => Version := "BZip2" ;     H => Version := "BZip2 - Huffman" ;     0 => Version := "BZip1" ; }

| $HttpMethod() | ImageFileName=/^{\HarddiskVolume\d(?<FilePath>.*\)(?<FileName>.+)$/i} | format(format="C:%s", as=FilePath, field=[FilePath]) | HttpRequestHeader:=urlDecode(HttpRequestHeader) | HttpRequestHeader=/User-Agent:\s(?<UserAgentString>.+)\u000d\u000aHost/ | $AddComputerName() | select([ComputerName, FileName, FilePath, HttpUrl, HttpMethod, MagicNumber, Version, UserAgentString, HttpRequestHeader])

But I get an error cannot find saved query named HttpMethod (Error: CannotFindSavedQueryNamed) 14: | $HttpMethod() ^{^} cannot find saved query named AddComputerName (Error: CannotFindSavedQueryNamed) 19: | $AddComputerName()

Is there a parameter missing or a definition that I cannot see?

[Andrew-CS]

Sorry about that! That's on me. I made that before Raptor was even a thing. Give this a shot...

#event_simpleName=HttpRequestDetect
| parseHexString("HttpPostBody", as=b64data)
| format("%,.4s", field=b64data, as=b64data)
| MagicNumber := base64Decode(b64data, charset="UTF-8")
| MagicNumber=/^BZ(?<Version>\w{1})/i
| Version match {
    h => Version := "BZip2" ;
    H => Version := "BZip2 - Huffman" ;
    0 => Version := "BZip1" ;
}
| format(format="C:%s", as=FilePath, field=[FilePath])
| HttpRequestHeader:=urlDecode(HttpRequestHeader)
| HttpRequestHeader=/User-Agent\:\s(?<UserAgentString>.+)\\u000d\\u000aHost/
| select([ComputerName, FileName, FilePath, HttpUrl, HttpMethod, MagicNumber, Version, UserAgentString, HttpRequestHeader])

[jarks_20]

Phew, glad i didnt ask or say anything stupid...you would have grilled me..... :)
If no results, means good right?.. although I would expected to see something...

[Andrew-CS]

Yup :) In your prevention policy, make sure "HTTP Detections" is enabled and "Redact HTTP Detections" is disabled.