Hi so we have some rules setup and i need to exclude specific ip from causing the rule to match - as this is regular daily activity that will happen. I have 2 quesitons, can modify the xlm to add the Exclude Workstation, i have added this so i see this in the parameter list but i know there has to be code to tell it to ignore this ip but am a little confused on exactly how the code should look.
here is example where i added the argument but i am stuck on code to say not in the excluded workstation array
<argument usedefault="false" displayname="User" name="User" description="User account the event was generated by." class="List">
<value>
<default description="Any string">"*"</default>
</argument>
<argument usedefault="true" displayname="Workstation" name="Workstation" description="Computer on which the logon attempt was performed." class="List">
<value>"*"</value>
<default description="Any string">"*"</default>
</argument>
<argument usedefault="true" displayname="Logon Type" name="Logon Type" description="Type of logon, such as interactive or network." class="RangeList">
<value>"2-2,3-3,10-10"</value>
<default description="Any number">"2","3","7","10"</default>
</argument>
<argument displayname="Excluded Workstations" name="Excluded_Workstations" class="List" description="A list of workstations to exclude, '-' is excluded by default.">
<value>"-"</value>
</argument>
</arguments>
<body>
_DataSourceName="Security" and
in(Computer, "wi", array(<parameter name="Computer"/>) ) and
(
not empty( regexp( "Security",Source,"i" ) ) and
in(AccountName, "wi", array(<parameter name="User"/>) ) and
(
in_range(EventID, "528") and
in(String7, "wi", array(<parameter name="Workstation"/>) ) and
in(String4, "wi", array(<parameter name="Logon Type"/>) )
)
) or
(
not empty( regexp( "Microsoft-Windows-Security-Auditing",Source,"i" ) ) and
(
in_range(EventID, "4624") and
in(String12, "wi", array(<parameter name="Workstation"/>) ) and
in(String9, "wi", array(<parameter name="Logon Type"/>)) and
(
in( String6, "wi", array(<parameter name="User"/>) ) or
in( strcat( String7, "\\", String6), "wi", array(<parameter name="User"/>) )
)
)
)
</body>
</filter></value>
</argument>
</arguments>
<prefilter>
<parameter name="Event filter"/>;
</prefilter>
<body>
<parameter name="Event filter"/>;
</body>
</rule>
any help would be greatly appreciated.