Search code examples
azureescapingazure-logic-appsazure-log-analyticsazure-sentinel

Escape and remove characters (dynamic content) in a logic app

I've been trying to fetch data from a REST API and then add it into Log Analytics in Azure using a Logic app. My issue is that it seems that I need to escape some characters in the body of the request to Log Analytics since I get a 400 with the error message:

{ "Error": "InvalidDataFormat", "Message": null }

I've checked and the JSON body is not valid.

My JSON request body looks like this:

{
"assetid": "TBD Assetid",
"vulnid": "@{items('For_each')?['id']}",
"key": "@{items('For_each_3')?['key']}",
"proof": "@{items('For_each_3')?['proof']}",
"since": "@{items('For_each_3')?['since']}",
"status": "@{items('For_each_3')?['status']}
}

The actual request looks like this:

{
"assetid": "TBD",
"vulnid": "adobe-flash-apsb15-11-cve-2015-3096",
"key": "C:\WINDOWS\system32\Macromed\Flash\",
"proof": "<p><p>Vulnerable OS: Microsoft Windows Server 2012 R2 Datacenter Edition<p></p></p><p>Vulnerable software installed: Adobe Flash 17.0.0.188 (C:\WINDOWS\system32\Macromed\Flash\)</p></p>",
"since": "2021-05-10T11:41:03.483Z",
"status": "vulnerable-version"
}

The issue seems to be the backslashes and the paragraphs elements.

I would like to escape the backslashes in "key" and "proof" and remove the paragraphs element. I've tried to search for a solution but most of the examples are with static strings and the replace function.

Any ideas?

Solution

  • You can use the replace functions to remove the escape characters & paragraph elements for the key parameter

    For Key parameter:

    replace(variables('string2'),'\',''

    You can also use replace for the proof parameter as well below is the expression.

    For proof parameter :

    replace(replace(replace(variables('string1'),'<p>',''),'</p>',''),'\',''))

    Here is the sample output for reference using the replace functions

    enter image description here

    Based on the above requirement , we understood that every time a html tag that is getting added to proof parameter might be different if that is the case " replace function () " wont help you.

    To remove those html characters you can adopt any of the below 2 methods:

    1. using the Html to text content version connector
    2. Using Azure functions as described in this article.