Check Event with Active List

[Pornsit]

If I have this Active List, and set condition NOTInActiveList

Customer Name	Destination User Name	Source Address
TEST	ADMIN
TEST		1.1.1.1

I want NOT event by checking AL and when some field has null value, I want to assume to anything like a wildcard.

For detail

Event Log A: CEF:0|Microsoft|Microsoft|1.0|traffic|monitor|Unknown| duser=ADMIN
Event Log B: CEF:0|Microsoft|Microsoft|1.0|traffic|monitor|Unknown| src=1.1.1.1

A missing src field, B missing duser field but I want to NOT these two event because field exist has match in AL. (do not check null field)

Somebody has solution please describe me, Thanks in advance.

[LewisJ]

Hi @Pornsit ,

If I understand correctly, you want a condition in a rule that says look up the active list value where the following conditions occur?

NOT (

OR (

AND (

activelistlookup.sourceUserName = admin and activelistlookup.sourceAddress is NULL

)

AND (

activelistlookup.sourceAddress = 1.1.1.1 and activelistlookup.sourceUserName is NULL

)

)

You should be able to do this by first creating a Local Variable in the rule for an ActiveList.

Call this variable (for example) "activelistlookup". Then in the conditions tab, you should be able to right click, go down to variables and see the activelistlookup.XXXXXX field names for the fields in your activelist. 

You may have to play around with key fields etc.... to get it working correctly, but this is a potential method in order to check individual fields within an activelist.

Let me know if this isn't super clear.

Thanks

Lewis

[Pornsit]

You mean I should create local variable with function GetActivelistValue, right?
We have ever use this function before and We
thought if null value in activelist can be over 20-30 field such as src,dst,shost,dhost,dvchost how can i check?

[Pornsit]

Focus on my use case
AL has below
Customer Name: test
Destination User Name: admin
Source Address:

Event Log A: CEF:0|Microsoft|Microsoft|1.0|traffic|monitor|Unknown| duser=admin src=7.7.7.7

You will see 7.7.7.7 in log do not match in active list because active list has null src
when you use key field to getActiveListValue it must require key field.

By concept this event it must be not in rule because duser match in activelist, src in activelist is null it must be wildcard it means it must match anything