cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

AND NOT logic (exclusions) in custom ESM rules

Hello.

Help me please. 

I want to create rule with this logic (processing single event)  - allowing 2 users to login from non-Europe.

 

(SigID = 123 AND SourceGeoId != Europe)

AND NOT (SourceIP=1.1.2.1 and SourceUser = 'ExternalUser1')

AND NOT (SourceGeoId=Asia and SourceUser = 'ExternalUser2')

 

So this event must NOT trigger:

SigID=123; SourceIP=1.1.2.1; SourceUser = 'ExternalUser1'

 

But this construction does not work (correlation rule triggers on event above):

rule2.PNG

 

Can you help me - how to realize the logic i want?

2 Replies
erelleke
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 3

Re: AND NOT logic (exclusions) in custom ESM rules

Your logic seems correct for the what you are asking. However, I will point out that is a lot of Not statements. These are very hard on any database and will be very demanding on resources.

Thank You,
Eric

Re: AND NOT logic (exclusions) in custom ESM rules

As I learn is that orange blocks inside AND block are not applied to single event. 1 orange block = 1 event in sequence, so my previous filter dont work because it wait for 3 different events in sequence. 

So if we want to realize alert if

(SigID = 123 AND SourceGeoId != Europe)

AND NOT (SourceIP=1.1.2.1 and SourceUser = 'ExternalUser1')

AND NOT (SourceGeoId=Asia and SourceUser = 'ExternalUser2')

 

We should to transform it to:

(SigID = 123 AND SourceGeoId != Europe AND SourceUser != ['ExternalUser1', 'ExternalUser2'])

OR (SigID = 123 AND SourceUser = 'ExternalUser1' AND SourceGeoId != Europe AND SourceIP=1.1.2.1 )

OR (SigID = 123 AND SourceUser = 'ExternalUser2' AND SourceGeoId != [Europe, Asia])

rule111.PNG

 

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community