Correlation rule match regex or contains

[ppineda]

Hi, I'm working with ESM 10.2

I want to do a correlation rule that triggers when the field "Process_Name" has a value of example firefox, chrome or iexplore. but I'm unable to make it work.

Example:

Process_Name: C:\PROGRAM FILES (X86)\GOOGLE\CHROME\APPLICATION\CHROME.EXE

regex(*/chrome/i*)  to do case insensitive and the rest of the string

but it says error when rollout.Need Help please

[David1111 · Accepted solution]

Hi

Sorry but your REGEX is not to effective..

try this:

(?i).*chrome.*

hope it helps

Best regards!

[ppineda]

Thanks

I'll give it a try and let you know what happens.

[David1111]

Hi ppineda

intrested if it workes.

please updeate the result

Best regards!

David

[ppineda]

Sorry for the wait.

I can confirm that it fired an event.

[David1111]

Thank you very much

Best regsards.

[BaverMentes]

Hi Sir,

I tried to write a regex for not contains.

This regex is working on Search but not on Corelation Rule.

This is my regex  Service_Name regex  ^((?!MpKs).)*$

My string is MpK1asd123

Do you have any suggestion for it?

Thanks

Regards

[NovaKatrina]

Hi,

I have the same issue, integrating regex on correlation rule field.

In filter it is working but in correlation rule field its not. I need a DOES NOT CONTAIN REGEX.of test.com.ph on "FROM" field

This is my code: ^((?!test\x2ecom\x2eph).)*$

Any suggestion for this?

Would appreciate any response.

Thanks.