Unable to decode base64 value - Kusto

%3CLINGO-SUB%20id%3D%22lingo-sub-2831021%22%20slang%3D%22en-US%22%3EUnable%20to%20decode%20base64%20value%20-%20Kusto%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2831021%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20need%20your%20assistance%20please.%3C%2FP%3E%3CP%3EI%20have%20the%20following%20query%3A%3C%2FP%3E%3CP%3E%3CBR%20%2F%3EF5_CL%3CBR%20%2F%3E%7C%20where%20TimeGenerated%20%26gt%3B%3D%20ago(3m)%20%2F%2Fchange%20to%20required%20time%3CBR%20%2F%3E%7C%20extend%20RawData%3Dsplit(RawData%2C%20'%23%23')%20%2F%2Fsplit%20all%20raw%20data%20to%20specific%20values%3CBR%20%2F%3E%7Cextend%20base64Value%20%3D%20tostring(RawData%5B24%5D)%20%2F%2F%20base64%20value%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIn%20the%20base64value%20there%20is%20base%2064%20value.%3C%2FP%3E%3CP%3EI%20don't%20know%20how%20to%20decode%20this%20value%20with%20extend!%3CBR%20%2F%3EI%20want%20that%20each%20parameter%20inside%20of%20this%20value%20will%20be%20separated.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWill%20appreciate%20your%20support%20please.%3C%2FP%3E%3CP%3EThanks!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2832097%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20decode%20base64%20value%20-%20Kusto%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2832097%22%20slang%3D%22en-US%22%3EThere%20are%20a%20few%20operators%20to%20decode%2C%20for%20strings%3CBR%20%2F%3E%3CBR%20%2F%3EF5_CL%3CBR%20%2F%3E%7C%20where%20TimeGenerated%20%26gt%3B%3D%20ago(3m)%20%2F%2Fchange%20to%20required%20time%3CBR%20%2F%3E%7C%20extend%20RawData%3Dsplit(RawData%2C%20'%23%23')%20%2F%2Fsplit%20all%20raw%20data%20to%20specific%20values%3CBR%20%2F%3E%7C%20extend%20base64Value%20%3D%20base64_decode_tostring(RawData)%20%2F%2F%20base64%20value%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2832774%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20decode%20base64%20value%20-%20Kusto%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2832774%22%20slang%3D%22en-US%22%3EWhen%20I%20send%20the%20following%20Query%3A%3CBR%20%2F%3EF5_CL%3CBR%20%2F%3E%7C%20where%20TimeGenerated%20%26gt%3B%3D%20ago(7h)%20%2F%2Fchange%20to%20required%20time%3CBR%20%2F%3E%7C%20extend%20RawData%3Dsplit(RawData%2C%20'%23%23')%20%2F%2Fsplit%20all%20raw%20data%20to%20specific%20values%3CBR%20%2F%3E%7C%20extend%20base64Value%20%3D%20base64_decode_tostring(RawData%5B24%5D)%20%2F%2F%20base64%20value%3CBR%20%2F%3E%3CBR%20%2F%3EI%20get%20the%20following%20error%3A%3CBR%20%2F%3E%22base64_decodestring()%3A%20argument%20%231%20was%20not%20of%20an%20expected%20data%20type%3A%20string%22%3CBR%20%2F%3E%3CBR%20%2F%3EWhen%20I%20check%20RawData%5B24%5D%20using%20gettype()%20function%2C%20the%20result%20is%20String.%3CBR%20%2F%3E%3CBR%20%2F%3EWhy%20I%20get%20this%20error%3F%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2832783%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20decode%20base64%20value%20-%20Kusto%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2832783%22%20slang%3D%22en-US%22%3ECould%20you%20post%20an%20example%20of%20your%20data%20to%20make%20it%20easier%3F%3C%2FLINGO-BODY%3E
Occasional Contributor

Hi,

 

I need your assistance please.

I have the following query:


F5_CL
| where TimeGenerated >= ago(3m) //change to required time
| extend RawData=split(RawData, '##') //split all raw data to specific values
|extend base64Value = tostring(RawData[24]) // base64 value

 

In the base64value there is base 64 value.

I don't know how to decode this value with extend!
I want that each parameter inside of this value will be separated.

 

Will appreciate your support please.

Thanks!

 

12 Replies
There are a few operators to decode, for strings

F5_CL
| where TimeGenerated >= ago(3m) //change to required time
| extend RawData=split(RawData, '##') //split all raw data to specific values
| extend base64Value = base64_decode_tostring(RawData) // base64 value
When I send the following Query:
F5_CL
| where TimeGenerated >= ago(7h) //change to required time
| extend RawData=split(RawData, '##') //split all raw data to specific values
| extend base64Value = base64_decode_tostring(RawData[24]) // base64 value

I get the following error:
"base64_decodestring(): argument #1 was not of an expected data type: string"

When I check RawData[24] using gettype() function, the result is String.

Why I get this error?
Could you post an example of your data to make it easier?

@m_zorich Adding picture, hope it more clear now.

You may need to check its valid UTF8, there are two examples in the github https://github.com/Azure/Azure-Sentinel/search?q=base64_decode_tostring , the second does some translate on invalid data.
Hi,
In the first example it will return error.
The second example is not clear.

So you are saying that the base64 is not UTF-8?
I can change it if needed...
Just need to understand the root cause of the issue.
I don't know if the F5 input is valid or not (it maybe ok), I was just saying that if you run the base64_decode_tostring against badly formatted/incorrect data it wont work if its not UTF-8.

https://en.wikipedia.org/wiki/UTF-8
The "RawData[24]" (base64 encoded value) is from UTF-8 type.
Again, any idea why sentinel returns the error?
And how to solve it of course?
Have you tried to use an online convertor to see if it will translate https://base64.guru/converter (or a website you prefer).
Have you tried to pass a working value, e.g. S3VzdG8= into you code

Usage
| extend RawData='S3VzdG8=' // replace with your string
| extend base64Value = base64_decode_tostring(RawData)
| distinct base64Value

@CliveWatson Yes, I've tried to use an online convertor and it translate well.

More than that, If I take the base64 as is, and move it to static variable as you showed, it works.

Otherwise it won't works.

Also, I've verified this is UTF-8.

 

Don't understand what I'm missing!

@MatRock345 

 

Maybe just a tostring within the Base64 - did we try that?  

e.g. base64_decode_tostring(tostring(RawData[24]))

 

let RawDataList = "S3VzdG8=##S3VzdG8=##S3VzdV8=";
Usage
| extend RawData=split(RawDataList, '##')
| extend base64Value = base64_decode_tostring(tostring(RawData[2]))

 

F5_CL
| where TimeGenerated >= ago(3m) //change to required time
| extend RawData=split(RawData, '##') //split all raw data to specific values
|extend base64 = base64_decode_tostring(tostring(RawData[24]))

Much better now! No error.
But all base64 values are empty! ((RawData[24]) is not empty)
Why is that?