I am trying to use a LDAP query for hostnames from an AD server, but all the hostnames come out in uppercase. So when I try to use this watchlist in a dashboard or correlation rule it wont work as the majority of the events in the siem have the hostname in lowercase
Is there any way to create or use a dynamic watchlist and have a case insensitive button or something similar when using Dashboards and correlation rules.
I have seen this being asked many times for over 5 yrs in the forums but have seen no response to add this as an improvement.