cancel
Showing results for 
Search instead for 
Did you mean: 
lhud64
Level 8
Report Inappropriate Content
Message 1 of 2

No Case insenstive option when using watchlist or correlation rules

I am trying to use a LDAP query for hostnames from an AD server, but all the hostnames come out in uppercase. So when I try to use this watchlist in a dashboard or correlation rule it wont work as the majority of the events in the siem have the hostname in lowercase

Is there any way to create or use  a dynamic watchlist and have a case insensitive button or something similar when using Dashboards and correlation rules. 

 I have seen this being asked many times for over 5 yrs in the forums but have seen no response to add this as an improvement.

1 Reply
David1111 Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 2 of 2

Re: No Case insenstive option when using watchlist or correlation rules

Hi, in the Dashboards you could press the Aa button and will be case insensitive.

in the correlation interface - theirs really no solution in the meantime.

Best Regards👍👍👍

David.

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community