cancel
Showing results for 
Search instead for 
Did you mean: 
asiff
Level 7

Value of watchlist are case sensitive ?

Hi All,

Kindly let me know values mentioned in the Watch list are case sensitive ?

0 Kudos
7 Replies
arnieos
Level 7

Re: Value of watchlist are case sensitive ?

Hi,

I also have the same question.

If anyone can answer this, we would greatly appreciate it.

Thanks.

0 Kudos
syed_rizvi
Level 10

Re: Value of watchlist are case sensitive ?

Yes, they are.

arnieos
Level 7

Re: Value of watchlist are case sensitive ?

Thanks a lot syed_rizvi...

0 Kudos
syed_rizvi
Level 10

Re: Value of watchlist are case sensitive ?

Your Welcome.  Here are some good examples of creating dynamic watchlists.

McAfee KnowledgeBase - How to filter the SIEM for users ending in a dollar ($) sign

0 Kudos
rth67
Level 12

Re: Value of watchlist are case sensitive ?

As mentioned by syed_rizvi, they are case Sensitive.

For Displays, Reports, and ELM Searches there are options for Case Insensitive Searches.

However for Correlation Rules and Field Match Alarm logic, there is not an option for Case Insensitive.

I submitted a new "Idea" (PER) on the new Ideas Forum for this, the more people that Vote on it, the higher priority it might receive when being reviewed and presented to Development.

To sign up for the new Ideas forum and begin submitting your Ideas, go to:
https://www51.v1ideas.com/IntelIdeas/ISecGForum

For more information, see KB60021 ( https://kc.mcafee.com/corporate/index?page=content&id=KB60021).

0 Kudos
syed_rizvi
Level 10

Re: Value of watchlist are case sensitive ?

rth67 wrote:

However for Correlation Rules and Field Match Alarm logic, there is not an option for Case Insensitive.

I submitted a new "Idea" (PER) on the new Ideas Forum for this, the more people that Vote on it, the higher priority it might receive when being reviewed and presented to Development.

To sign up for the new Ideas forum and begin submitting your Ideas, go to:
https://www51.v1ideas.com/IntelIdeas/ISecGForum

For more information, see KB60021 ( https://kc.mcafee.com/corporate/index?page=content&id=KB60021).

Great PER idea

0 Kudos
acommons
Level 10

Re: Value of watchlist are case sensitive ?

The data type may influence the outcome here.

In the Filters panel you will see the option case insensitive option - Aa - for some, but not all, fields. If that option is present then case sensitivity will be in play, if it is not present, for example on a alphanumeric MAC address or Protocol field, you may have to experiment to be sure.

0 Kudos