Just a question we are ingesting MISP logs through ingestion api we have the fields parsing now and we can search for them in raw log search. We cannot however find any field using udm search how would we be able to utilize this in Yara-l rules?

Good morning, I have a question about log ingestion via the ingestion API. Initially, my logs contained only 13 fields for testing purposes. However, I later expanded them to include 22 fields. I built a custom parser, and when I preview it, the UDM ...