Create a filter for an application with multiple signatures?

[rskadish-dexia]

Hello,

I'm wondering if there is an easy way to filter out events where the "Application" field is the same, but where different Signature IDs are involved. 

We have some VmWare ESX servers which are VERY chatty.  All of the events coming in with the application "vxpa" are not useful from a security perspective.  I could disable the ASP rules one by one, but there are a lot of them involved. 

Any help is apperciated!

Thanks,

- Steve

[akerr]

You absolutely can write filters, but they happen before the parsers, so you'll have to do it with regex.  

In the Policy Editor, Expand Receivers and click Filters.  You can add a new filter there.  I'd suggest only enabling it on the data sources you want it to apply to however, rather than globally.

[rskadish-dexia]

Hi akerr,

Thanks for the response.  I do know about the filters, and have written a bunch.  However, for each of these different signatures that are involved, I'd need to write a different Regex, which will be a lot of work.  That's why I was looking for an easier solution. 

The other part of the filter rules (besides PCRE) is "Content Strings."  I thought that if I put "vpxa" as a content string and made it case-insensitive, that would do the trick.  Certainly "vpxa" is a string that is in these packets.  However, it doesn't seem to work.  Is there a particular format for content strings?

Thanks,

- Steve

[akerr · Accepted solution]

Content strings are just a very simple string match, rather than regex.  So it should work, but I'd be hesitant to base it on such a short string.

[rskadish-dexia]

Thank you! I created the filter and it seems to be working (I'm not sure what I did wrong with the content string the first time.) I'll play with it and make sure that it's not "too" effective.