ProTip for SIEM: How to use regex to query ELM in the most efficient manner

Version 1

    The ELM uses bloom indexes to optimize queries. While almost any Perl Compatible Regular Expression (PCRE) can be used for ELM searches, not every PCRE expression can be optimized to use the bloom. For more information on how to use regex to efficiently query ELM, see KB86052.