Absent Member.
Absent Member.
562 views

Problem with filter matching on source address and destination address

Jump to solution

I have a Filter, a Query, and a QueryViewer.  The query is set up to match the filter, and the query viewer shows the results of the query.  I'm using the filter to match events that occur between sets of IP addresses, so it looks something like this:

(sourceAddress=1.2.3.4 OR sourceAddress=5.6.7.8 OR sourceAddress=9.8.7.6) AND (destinationAddress=1.2.3.4 OR destinationAddress=5.6.7.8 OR destinationAddress=9.8.7.6)

The problem I'm having is that when I add a fourth address, I will not get any events that match that address.  After experimenting with it, I've found that sometimes adding additional addresses (using an OR operator on each side of the AND) will sometimes narrow the results and sometimes expand the results, when I would expect an OR operator to always expand results.  I'm testing this by manually sending CEF log messages to Arcsight and setting the src, dst, spt, and dpt fields.  Everything seems to work fine if I'm just trying to match pairs of one, two, or three addresses.

Any ideas what might be going on here?

Labels (1)
0 Likes
1 Solution

Accepted Solutions
Absent Member.
Absent Member.

I figured out a solution.  The filter needs to match Attacker Address and Target Address as well as Source Address and Destination Address.  Not sure why.

View solution in original post

0 Likes
1 Reply
Absent Member.
Absent Member.

I figured out a solution.  The filter needs to match Attacker Address and Target Address as well as Source Address and Destination Address.  Not sure why.

View solution in original post

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.