No Case insenstive option when using watchlist or correlation rules
I am trying to use a LDAP query for hostnames from an AD server, but all the hostnames come out in uppercase. So when I try to use this watchlist in a dashboard or correlation rule it wont work as the majority of the events in the siem have the hostname in lowercase
Is there any way to create or use a dynamic watchlist and have a case insensitive button or something similar when using Dashboards and correlation rules.
I have seen this being asked many times for over 5 yrs in the forums but have seen no response to add this as an improvement.
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.
Community Help Hub
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.