Skip to main content
adem_netsys
adem_netsys
Explorer III
July 1, 2026
Question

Using Watchlist

  • July 1, 2026
  • 1 reply
  • 27 views

Hello Guys,

I’m hoping for your help with something. We have a list of string values, and we want to search for a specific word within that list and trigger a rule based on that. For example, we want to search for the word “usert” within the string “testusertest” in the list and create a rule based on that. Do you have any ideas on this?

Thanks in advance

    1 reply

    Muttahar_Rehman
    Muttahar_Rehman
    Explorer
    July 6, 2026

    A Watchlist uses exact match or IN operator meaning if your watchlist contains “testusertest”, a rule condition checking if an event attribute is IN the watchlist will only match the exact string “testusertest”. It will not find “usert” as a substring within it. Watchlists don't support substring/CONTAINS lookups natively.

    If your goal is to trigger a rule when an event attribute contains the substring “usert”, skip the watchlist entirely and use CONTAINS directly in the rule subpattern filter:

    Attribute: <your field, e.g. User>
    Operator: CONTAIN
    Value: usert


    Use REGEX operator in the rule:

    Attribute: <your field>
    Operator: REGEX
    Value: usert | anotherusert | keyword3

    Thanks, R3hsec
    Terms & ConditionsAccessibility statement