About Ange

Ange · ‎09-22-2022

@gcusello I checked with below and now it works correctly | regex file_path="\d{13}xx.exe" Thank you very much for your great support!

Ange · ‎09-22-2022

@gcusello Thank you for your reply and support! The number of digits are always 13, so I checked with the second one like below. | rex "(?<file>\d{13}xx\.exe)$" | search NOT file=* | start count by file | sort - count Although it couldn't work accurately. In addition, just in case, I checked like this. | rex "(?<file>\d\d\d\d\d\d\d\d\d\d\d\d\dxx\.exe)$" | search NOT file=* | start count by file | sort - count But the result was the same. It seems "\d" is not working correctly on my computer.

Ange · ‎09-22-2022

Hi, everyone. Need some help for detection exclusion setting. Want to exclude detections of the files which are applicable to the file path below. c:\users\01234567\downloads\1234567890123xx.exe For preventing alerts, I would like to use "13 digits number" and "xx.exe" as indicators. For now, I found it can be excluded only by "xx.exe." ex) file_path="*xx.exe" Although, when I use regex like below, it doesn't work. ex) file_path="*\d{13}xx.exe" Could you please let me know how to set both "13 digits number" and "xx.exe" as indicators for excluding detections?

Posts	3
Solutions	0
Karma Given	4
Karma Received	0
Member Since	‎09-22-2022

Online Status	Offline
Date Last Visited	‎10-31-2022 05:44 AM

Detection exclusion setting by using Regex?

Re: Detection exclusion setting by using Regex

Re: Detection exclusion setting by using Regex

Detection exclusion setting by using Regex?

Join the Conversation

Detection exclusion setting by using Regex?

Re: Detection exclusion setting by using Regex

Re: Detection exclusion setting by using Regex

Detection exclusion setting by using Regex?