Hi
Anyone tried to use negative regexp in correlation rules filters?
I tried to do something like alert database events releated with 'create' something exclude e.g
create table
create index
create procedure and so one.
I did something like that but this don't work. I get alert when someone create table.
Mayby enVISION don't recognize negative regexp? What's the best way to do that?
