1

I've been trying to find ways to print the individual data but can't seem to figured out where I'm going wrong.

I started with this but I get no results. Before this I tried nesting loops but also got nowhere either.

$data = curl_exec($ch);
$d = json_decode($data, true);
foreach($d as $k=>$v){
echo $v['value']['displayName'];
}

Then I tried the following with only got me some of the results. I'm not sure where I'm going wrong with this.

foreach(json_decode($data,true) as $d){
 foreach($d as $k=>$v){
  foreach($v as $kk=>$vv){
   echo $kk.$vv;
   }
  }
}

The JSON looks like the following:

{
  "value": [
    {
      "id": "",
      "name": "",
      "etag": "",
      "type": "Microsoft.SecurityInsights/alertRules",
      "kind": "Scheduled",
      "properties": {
        "incidentConfiguration": {
          "createIncident": true,
          "groupingConfiguration": {
            "enabled": false,
            "reopenClosedIncident": false,
            "lookbackDuration": "PT5M",
            "matchingMethod": "AllEntities",
            "groupByEntities": [],
            "groupByAlertDetails": null,
            "groupByCustomDetails": null
          }
        },
        "entityMappings": [
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "identifier": "FullName",
                "columnName": "AccountCustomEntity"
              }
            ]
          },
          {
            "entityType": "IP",
            "fieldMappings": [
              {
                "identifier": "Address",
                "columnName": "IPCustomEntity"
              }
            ]
          }
        ],
        "queryFrequency": "P1D",
        "queryPeriod": "P1D",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0,
        "severity": "Medium",
        "query": "",
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "Reconnaissance",
          "Discovery"
        ],
        "displayName": "MFA disabled for a user",
        "enabled": true,
        "description": "Multi-Factor Authentication (MFA) helps prevent credential compromise. This alert identifies when an attempt has been made to diable MFA for a user ",
        "alertRuleTemplateName": null,
        "lastModifiedUtc": "2022-11-14T02:20:28.8027697Z"
      }
    },
...
...
...
Jason
  • 811
  • 1
  • 12
  • 26

1 Answers1

1

Here is how you can get the display name without a loop. Notice that the 0 is the key value of the array since it doesn't have a name.

We start from the value, and we move one layer deeper by selecting the first array 0. Now we need to select the properties and finally, we can get the displayName from there.

$displayName = $d["value"][0]["properties"]["displayName"];
echo($displayName);

/*
Here is a quick demonstration:

value:
{
    0:
    {
        ...
        properties:
        {
            ...
            displayName: [We made it!]
        }
    }

}

*/

And here is a very good post that explains this in more detail

How to decode multi-layers nested JSON String and display in PHP?

Ere Männistö
  • 518
  • 2
  • 20
  • This helped. So I didn't realize properties was nested inside, which messed me up. I got it now! :) – Jason Dec 04 '22 at 03:17
  • 1
    That's good to hear! I have recently been struggling with this too so it's all fresh in my memory. Finding the correct path to the right value can get tricky in big files. I have noticed that going backward from the goal to the beginning can be helpful, just like reversing a maze. Just remember to mark all the parents on your way up and the job is done. – Ere Männistö Dec 04 '22 at 03:23