Unable to drop events Under event Handling.

Forum|Forum|7 months ago
January 19, 2026
3 replies
258 views

Hi everyone,

I’m trying to drop all CrowdStrike logs except those that contain the tag SensorGroupingTags/ABC.

I’ve configured an event-dropping rule as shown in the screenshot, but I’m still receiving all CrowdStrike logs instead of only the ones with the specified tag.

Has anyone encountered this issue or can point out what might be wrong with the rule logic?

Regex: ^(?!.*SensorGroupingTags/ABC).*

@Gabe_FTNT @Secusaurus @AEH

Fortisiem

Gabe_FTNT

Staff

Hi @doosa

I don't see a screenshot nor have I worked with CrowdStrike logs, but your regex looks suspicious. Question marks have a special meaning (= optional occurence of preceding character). Putting it after a parenthesis (= creating a back-reference), does not make sense to me. Posting a sample log may help to understand what you try to match.

doosaAuthor

New Member

image (3).jpg Hi @Gabe_FTNT
the regex match anything but must not contain SensorGroupingTags/ABC.
then the dropping rule should them.

image (3).jpg

REGEX: ^(?!.*SensorGroupingTags\/ABC).*

Gabe_FTNT

Staff

@doosa It may well be that FortiSIEM does not support lookahead assertions in the regex filters in this context. I sure haven't seen them and couldn't find any FortiSIEM documentation about it either. Unfortunately I have no FortiSIEM available to quickly test this.

I'd therefore suggest you test matching with regex patterns that do not include any lookahead assertion.

Sign up

Login with SSO

Login to the community

Login with SSO