usage of wild card mask "%" in app rule for End Point Hybrid

[YounisKhan]

I am looking for a guidance to edit/ update APP rules in EndPoint log hybrid in which we have multiple param.dst which contains same parameter with only one or two words change. so instead of adding multiple queries i want to add only one same like we were using in ECAT as "%" as DB is changed now.

[JoshRandall]

@YounisKhan You would need to use the regex operator in your app rule to accomplish this.

https://community.rsa.com/t5/rsa-netwitness-platform-threat/application-rules-cheat-sheet/ta-p/564501

e.g.: ... && filename regex '(bash_|zsh_|z)?history' && ...