NetWitness Community

huanzhou1 · ‎2013-12-24

can decoder app rule or network rule using list?

RSAAdmin · ‎2013-12-26

Yes, with limitations. To denote a list in a rule, simply separate your values with commas. For instance, I have a list of malicious domains I want to alert against. It would be alias.host=xyz.com,xyz.org,xyz.il,xyz.biz

The limitations come into play when you try to use too many values in your list. Or when you try to do contains or begins statements for your rule.

If you have more than 10 values, I'd suggest you craft a custom feed and query against the feed name.

View solution in original post

RSAAdmin · ‎2013-12-26

Yes, with limitations. To denote a list in a rule, simply separate your values with commas. For instance, I have a list of malicious domains I want to alert against. It would be alias.host=xyz.com,xyz.org,xyz.il,xyz.biz

The limitations come into play when you try to use too many values in your list. Or when you try to do contains or begins statements for your rule.

If you have more than 10 values, I'd suggest you craft a custom feed and query against the feed name.

huanzhou1 · ‎2013-12-26

how should i do that use feed name?

RSAAdmin · ‎2013-12-26

You would use the feed wizard to load your custom feed. Then your rule would be feed.name exists, or whatever other logic you are trying to query against. See the help file for managing local feeds.