cancel
Showing results for 
Search instead for 
Did you mean: 

regular expressions & correlation rule

Hello,

I need to create a new correlation rule  filtered only on source user beginning with  "XX" (case insensitive).

Do you know if you can use regular expression (regex) in correlation rule  to filter source user?

If yes,  how can I set it?

If no, other solutions?

Thank you

4 Replies
abanaru
Level 11
Report Inappropriate Content
Message 2 of 5

Re: regular expressions & correlation rule

Tried this morning by creating a correlation rule with Source User in regex(^[Aa]dmin.*$) and it did not fire.

I don't think it's supported because of the load it might put on the correlation engine.

Maybe you can achieve the same thing by creating a dynamic watchlist and query the user database, then use that watchlist in your correlation rule.

Highlighted

Re: regular expressions & correlation rule

Hi

As mentioned above you have to create dynamic watchlist with type ESM string.

Insert the reqex into search and set in values type source user.

After this you can call this watchlist in CRL

Mike

Re: regular expressions & correlation rule

Maybe try this:

(?i)^((xx).*)$(?-i)

proxima
Level 10
Report Inappropriate Content
Message 5 of 5

Re: regular expressions & correlation rule

Hi,

You cannot use a regex syntax in a source user field.

In correlation rule you can only to that for Random String fileds (Source User is String).

You can achieve smth similar using dynamic watchlist (like Mike said) or if you want to monitor some specific events/devices you can modify a parser and assign user to some random string field and than used them in correlation.

If you have some questions let me know.

Regards

MK

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community