"Join conditions must match" in ESA Rule condition

[MassimilianoCre]

Hello community,

I am new to using the RSA NetWitness product.

I started reading the ESA Rule documentation to try create a custom correlation but I have problems.

(Version Product 11.4.0.0)

I create a ContextHub List containing malicious hash (SHA256).

I add the CH list in ESA Rule tab --> Settings --> Enrichment Souces

After this I created a rule with this condition:

but when i try to save i get this :

Then I don't understand why I can't remove the first condition

where am i wrong?
Can someone help me.

Max

[SolayappanAdaik]

Hello Massimiliano Crescenzi, 
Looks like when mapping String[] to a Context Hub list in Basic Rule Builder, we see an exception. Its should be fixed in the next release. For the time being you should be able to accomplish the same from an advanced rule builder by using @UsesEnrichment(name='<ContexthubList>')

Please check https://community.rsa.com/docs/DOC-85972#Use for additional information

Example EPL Syntax for whitelists:

/* A whitelist ("known good") is a list of event meta value to exempt from alerts. */

@RSAAlert(oneInSeconds=0, identifiers={"user_dst"})
@UsesEnrichment(name="User_Whitelist")
SELECT * FROM
Event (

medium = 32
AND ec_activity = 'Logon'
AND ec_outcome = 'Success'
AND logon_type IN ('2','10','11','12')
AND NOT EXISTS (SELECT * FROM User_Whitelist WHERE (LIST = Event.user_dst.toLowerCase())));