Hi, I have a case when I want to create an alert for a specific event
only if another event did not preceded that specific event. To give more
context: if an email gateway 'reputation' event happened for an IP, the
firewall alert rule for that same I...
I since figured it out:SELECT * FROM Event( medium IN ( 32 ) AND
device_class.toLowerCase() IN ( 'firewall' ) AND
isOneOfIgnoreCase(action,{ 'accept' }) ).win:length(1) WHERE NOT EXISTS
( SELECT ip_src FROM emailGateway WHERE emailGateway.ip_src =
Ev...
Now that I had some time to test this method thoroughly I've realized
the problem that causes the issue is not in the presentation of the
data, but rather how it is being created (rule issue). Looking at the
previous example I used, if I had .111, .1...
Thank you Josh! It really does make sense - of course there isn't a
B.ip_src, that's what I wanted in the first place! Silly me. I was
playing around with the rule you wrote, and it does work technically -
but aesthetically... The alert contains all ...
Hi Petar!Yes, it is possible to have a report like that. In Netwitness
when you receive a log, it will have either the device.host (usually
some kind of server) or the device.ip (often network devices) meta
filled. If you make 2 report rules (one for...
