InTrust

Forum Custom real time monitoring rule for event id with a string Value

State Verified Answer
Replies 2 replies
Subscribers 14 subscribers
Views 2197 views
Users 0 members are here

Options

Related

Custom real time monitoring rule for event id with a string Value

ian l burrows ctr over 3 years ago

im trying to build an real time monitoring rule for when the CAC requirement is turned off for any account on our network.

My issue is the event ID is shared. and im unable to get any event filter to check for a string value.

the Event ID is 4738 and the String value should be (is#24) "%%2060"

has anyone had any experience with custom real time monitoring rules?

Top Replies

Igor.Ilyin over 3 years ago +1 verified

Hi Ian,

The rule matching expression could be like:

<rule type="REL" version="1.0">
<arguments>
<argument displayname="Search String" name="SS" class="Text" description=…

+1 Igor.Ilyin over 3 years ago

Hi Ian,

The rule matching expression could be like:

<rule type="REL" version="1.0">
<arguments>
<argument displayname="Search String" name="SS" class="Text" description="A substring to search in the Insertion String 24.">
<value>"2060"</value>
</argument></arguments>
<body>
EventID = 4738
and strstr(String24, <parameter name="SS"></parameter>) != -1;
</body>
</rule>
Cancel
Up +1 Down

Reply

Verify Answer

Reject Answer

Cancel
0 ian l burrows ctr over 3 years ago in reply to Igor.Ilyin

thanks, so it looks like i was getting in my own way trying to use the Pre populated arguments.
Cancel
Up 0 Down

Reply

Verify Answer

Cancel