Can we add wildcards in Watchlist

Forum|Forum|9 months ago
August 28, 2025
4 replies
928 views

Hi All,

I want to create a watchlist with around 100 keyword entries.
Each entry contain wildcards (*).
In rule condition, I want FortiSIEM to check whether an event attribute matches any of the wildcard (regex) patterns from the entire watchlist.
If a match is found → the rule should trigger an incident.

could some one guide how to achieve this ? does SIEM support wildcards ?

@Secusaurus @Anthony_E could you please help here

Fortisiem

gauravpawarAuthor

Explorer III

@tylerkelley1980 thanks for sharing will try this

Secusaurus

Contributor III

Hi everyone,

Just as a note: At the moment, a workaround is the only option. The database query using watchlists only understands "is it in the list?", which means a 100% match.

You could, however, have a look at the Advanced Queries (from 7.3 onwards), which is coming more and more to the rules as well, and try to build something to improve your lookup. But this also has limitations at the moment.

Best,

Christian

NSE8 | Fortinet Advanced MSSP Partner