Hello
I have the following situation I want to create a rule from a watchlist that have machines names like "pcexample$" or "pczzyy$" this list is populated with events in Active Directory. I want to correlate this watchlist with events that i see in another data source, but in this data source the machine names are like "PCEXAMPLE" or "PCZZYY". How can i transform the data in a watchlist from "pcexample$" to "PCEXAMPLE"?
Thanks
Hi - Watchlists are case sensitive. The best thing to do would be to open the Watchlist, go to values and export the data to a file. You can run a convert to uppercase (several editor do that) then add that as a new Watchlist. I would then use both Watchlists in your rule, to catch both possibilities.
Thank you, but i need an automatic way to do this, it's something that we have to do several times by day.
Hi Layer0,
you can extract all of your Hostname from the ESM. The thing is you need the right regex string.
Watchlist --> Add --> Dynamic--> Source --> ESM String --> your Regex --> value -->
Type --> Host
(Regex: its easy to regex the ESM string if you now a prequel from you hostnames like "xyz" or something else.
Your company Hostnames are like xyz1234
So you have a regex with ([xyz\d{0-3}]+)
Best solution
Corporate Headquarters
6220 America Center Drive
San Jose, CA 95002 USA