Hello, First, I'm very new to EPL and fairly new to NetWitness, so sorry
for the basic question. I'm trying to modify the OOB "Malware Dropper"
rule to not include events with certain alias_host fields. I created a
variable like so:create variable st...
My solution, for it anyone else comes along behind me:
...ANDalias_host.allOf(i => i != all(Dropper_Whitelist))...This iterates
over alias_host as i and returns true if, and only if, I does not match
any value in Dropper_Whitelist.
