cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted
Level 9
Report Inappropriate Content
Message 1 of 2

hit count on whitelist entries

Jump to solution
Hello i need to know what and how many times my entries in all whitelists are matched, like a hit count feature. This comes from a customer request for deleting all old and not used entries. Is this feature present ? or is it satisfable in some way ? thanks Giuliano Buraschi
1 Solution

Accepted Solutions
Highlighted
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 2 of 2

Re: hit count on whitelist entries

Jump to solution

Hello Giuliano,

I think it is possible but needs some work (especially if you have many whitelist rules):

In each whitelist rule create a new event to write a log with a name of the white list and a : List.LastMatches property 

This will create a log with following content:

"Global Whitelist" "www.microsoft.com"

"SSL Whitelist" "*.example.com"

"URL Whitelist" "mcafee.com"

Wait a day/week/month and analyze the log with following command:

 

sort test.log | uniq -c | sort -gr

 

 

you'll get a list of matching entries incl list names.

after that you need to compare your whitelists with the results to find non matching entries - using a script, or excel or splunk or manually.

another option is to use PDStorage and/or Map.HasKey, but this will require even more work...

View solution in original post

1 Reply
Highlighted
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 2 of 2

Re: hit count on whitelist entries

Jump to solution

Hello Giuliano,

I think it is possible but needs some work (especially if you have many whitelist rules):

In each whitelist rule create a new event to write a log with a name of the white list and a : List.LastMatches property 

This will create a log with following content:

"Global Whitelist" "www.microsoft.com"

"SSL Whitelist" "*.example.com"

"URL Whitelist" "mcafee.com"

Wait a day/week/month and analyze the log with following command:

 

sort test.log | uniq -c | sort -gr

 

 

you'll get a list of matching entries incl list names.

after that you need to compare your whitelists with the results to find non matching entries - using a script, or excel or splunk or manually.

another option is to use PDStorage and/or Map.HasKey, but this will require even more work...

View solution in original post

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community