2013-02-05
04:33 AM
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Negative Regexp in correlation rules
Hi
Anyone tried to use negative regexp in correlation rules filters?
I tried to do something like alert database events releated with 'create' something exclude e.g
create table
create index
create procedure and so one.
I did something like that but this don't work. I get alert when someone create table.
Mayby enVISION don't recognize negative regexp? What's the best way to do that?
- Tags:
- Community Thread
- correlation
- Discussion
- enVision
- filters
- Forum Thread
- negative
- regexp
- RSA enVision
- Rules
0 Replies
