- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
strange IMDB query results in RE
any ideas?
for IMDB in RE
select alert.name, alert.source, alert.signature_id
where alert.name exists && alert.source exists && alert.signature_id exists && alert.source='Event Stream Analysis' && alert.signature_id!='592d254bf280453f1bb37b3a'
times out and crashes RE.
alert.name exists && alert.source exists && alert.signature_id exists && alert.source='Event Stream Analysis' && alert.name contains 'Tier 1'
returns alert with tier 5
alert.name exists && alert.source exists && alert.signature_id exists && alert.source='Event Stream Analysis' && alert.name regex '%Tier 1%'
returns alert with tier 5
- Tags:
- Community Thread
- Discussion
- Forum Thread
- imdb results for not equals or contains or regex
- NetWitness
- NW
- NWP
- RSA NetWitness
- RSA NetWitness Platform
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Can you provide a simple select on the data and include column headers so we can take a look at the logic? Obfuscate the data that's not important for this query if you have to.
