cancel
Showing results for 
Search instead for 
Did you mean: 

RegEx format for Field Match Alarms

Jump to solution

What is the proper RegEX format for Field Match alarms? I'm trying to implement a very simple RegEx match for the word hidden, case insensitive. Normally this would just be /(hidden)/i but it doesn't seem to work in the Field Match alarm section

hidden.jpg

The filter for "hidden" or "Hidden" seems works fine, so i've narrowed the problem down to the RegEx match, not the alarm logic itself.

For context this is parsing PowerShell logs to look for PS execution trying to hide the window.

Any help appreciated

Thank you!

1 Solution

Accepted Solutions
Highlighted
McAfee Employee andy777
McAfee Employee
Report Inappropriate Content
Message 2 of 3

Re: RegEx format for Field Match Alarms

Jump to solution

How does it do with ((h|H)idden)?

View solution in original post

2 Replies
Highlighted
McAfee Employee andy777
McAfee Employee
Report Inappropriate Content
Message 2 of 3

Re: RegEx format for Field Match Alarms

Jump to solution

How does it do with ((h|H)idden)?

View solution in original post

Re: RegEx format for Field Match Alarms

Jump to solution

Hey Andy, thanks for the reply, I tried on the "D" character instead, no dice.

hidden2.jpg

And the event:

hidden3.jpg

Edit: After some fiddling, this worked. Thank you, how do I implement other other RegEx functions, like "ends with" for example, the traditional dollar sign after the text doesn't seem to work. Is there a standard format of RegEx that the field match is expecting?

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community