AnsweredAssumed Answered

Lists in Report Rules

Question asked by Michael Pochan on Jan 24, 2017
Latest reply on Jan 25, 2017 by Michael Pochan

I'm attempting to create a rule that will ingest a list of partial hostnames and spit out their associated IPs based on DNS traffic traffic. 

 

 

When attempting to run it, I get the following error (Broker name and IP redacted)

 

 

I've gone through the logs and there are no more details. If there is only one line in the list, it works fine. However, when there are multiple values/lines in the list, I get this error. 

 

I assume I'm missing something obvious. 

Outcomes