Fine tunning of 'remote directory Traversal'

[YounisKhan]

App rule 'remote directory Traversal'  generating high number of alerts on EPLH, and I tried to fine tune this app rule but whenever i tried to filter based on "param.src" all Mata keys disapper. This app rule is very generic and it need a lot of fine-tuning , but very limited options for fine-tuning. if someone did fine-tuning for this app rule, please share based on which key get the desired result.

[VincentWareham]

Hello Younis

The remote_directory_traversal.nwr contains the following syntax

name="remote directory traversal" rule="device.type = 'nwendpoint' && OS = 'windows' && category = 'console event' && filename.src='cmd.exe','powershell.exe' && param.src exists && param.src regex '(dir|tree).*?\\.*?$'" alert=boc order=1 type=application

What are you changing the param.src to so it returns no meta?