Check Event with Active List
If I have this Active List, and set condition NOTInActiveList
|Customer Name||Destination User Name||Source Address|
I want NOT event by checking AL and when some field has null value, I want to assume to anything like a wildcard.
Event Log A: CEF:0|Microsoft|Microsoft|1.0|traffic|monitor|Unknown| duser=ADMIN
Event Log B: CEF:0|Microsoft|Microsoft|1.0|traffic|monitor|Unknown| src=184.108.40.206
A missing src field, B missing duser field but I want to NOT these two event because field exist has match in AL. (do not check null field)
Somebody has solution please describe me, Thanks in advance.
Hi @Pornsit ,
If I understand correctly, you want a condition in a rule that says look up the active list value where the following conditions occur?
activelistlookup.sourceUserName = admin and activelistlookup.sourceAddress is NULL
activelistlookup.sourceAddress = 220.127.116.11 and activelistlookup.sourceUserName is NULL
You should be able to do this by first creating a Local Variable in the rule for an ActiveList.
Call this variable (for example) "activelistlookup". Then in the conditions tab, you should be able to right click, go down to variables and see the activelistlookup.XXXXXX field names for the fields in your activelist.
You may have to play around with key fields etc.... to get it working correctly, but this is a potential method in order to check individual fields within an activelist.
Let me know if this isn't super clear.
We have ever use this function before and We
thought if null value in activelist can be over 20-30 field such as src,dst,shost,dhost,dvchost how can i check?
AL has below
Customer Name: test
Destination User Name: admin
Event Log A: CEF:0|Microsoft|Microsoft|1.0|traffic|monitor|Unknown| duser=admin src=18.104.22.168
You will see 22.214.171.124 in log do not match in active list because active list has null src
when you use key field to getActiveListValue it must require key field.
By concept this event it must be not in rule because duser match in activelist, src in activelist is null it must be wildcard it means it must match anything