Using Watchlist

1 reply
89 views

Hello Guys,

I’m hoping for your help with something. We have a list of string values, and we want to search for a specific word within that list and trigger a rule based on that. For example, we want to search for the word “usert” within the string “testusertest” in the list and create a rule based on that. Do you have any ideas on this?

Thanks in advance

Fortisiem

Muttahar_Rehman

Explorer II

A Watchlist uses exact match or IN operator meaning if your watchlist contains “testusertest”, a rule condition checking if an event attribute is IN the watchlist will only match the exact string “testusertest”. It will not find “usert” as a substring within it. Watchlists don't support substring/CONTAINS lookups natively.

If your goal is to trigger a rule when an event attribute contains the substring “usert”, skip the watchlist entirely and use CONTAINS directly in the rule subpattern filter:

Attribute: <your field, e.g. User>
Operator: CONTAIN
Value: usert

Use REGEX operator in the rule:

Attribute: <your field>
Operator: REGEX
Value: usert | anotherusert | keyword3

Thanks, R3hsec

Sign up

Login with SSO

Login to the community

Login with SSO