lperlak

Negative Regexp in correlation rules

Discussion created by lperlak on Feb 5, 2013

Hi

Anyone tried to use negative regexp in correlation rules filters?

 

I tried to do something like alert database events releated with 'create' something exclude e.g

create table

create index

create procedure and so one.

 

I did something like that but this don't work. I get alert when someone create table.

 

Mayby enVISION don't recognize negative regexp? What's the best way to do that?

 

54275

Outcomes