Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Exception Rule not working
Hi Guys,
I try to create exception rule by clicking incident -> Action > Edit Rule Exception.
but it still trigger the incident. Any ideas?
Labels:
- Labels:
-
SIEM
2 REPLIES 2
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Muhammad,
The operator contains is checking for an exact string match where Info URL contains the string literal "teamviewer.com, digicert.com", it is not treating this as a list.
You could probably do this two ways.
Probably the most reliable way to exclude:
Info URL CONTAINS teamviewer.com OR
Info URL CONTAINS digitcert.com
An alternative is to try:
Info URL IN "teamviewer.com","digicert.com" -- Where the IN is an exact match of the info url. e.g. teamviewer.com won't match test.teamviewer.com or test2.teamviewer.com
The operator contains is checking for an exact string match where Info URL contains the string literal "teamviewer.com, digicert.com", it is not treating this as a list.
You could probably do this two ways.
Probably the most reliable way to exclude:
Info URL CONTAINS teamviewer.com OR
Info URL CONTAINS digitcert.com
An alternative is to try:
Info URL IN "teamviewer.com","digicert.com" -- Where the IN is an exact match of the info url. e.g. teamviewer.com won't match test.teamviewer.com or test2.teamviewer.com
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the reply
