2018-07-11 04:41 AM
any ideas?
for IMDB in RE
select alert.name, alert.source, alert.signature_id
where alert.name exists && alert.source exists && alert.signature_id exists && alert.source='Event Stream Analysis' && alert.signature_id!='592d254bf280453f1bb37b3a'
times out and crashes RE.
alert.name exists && alert.source exists && alert.signature_id exists && alert.source='Event Stream Analysis' && alert.name contains 'Tier 1'
returns alert with tier 5
alert.name exists && alert.source exists && alert.signature_id exists && alert.source='Event Stream Analysis' && alert.name regex '%Tier 1%'
returns alert with tier 5
2018-07-11 08:31 AM
Can you provide a simple select on the data and include column headers so we can take a look at the logic? Obfuscate the data that's not important for this query if you have to.