Skip to content
  • There are no suggestions because the search field is empty.

RSA NetWitness Logs & Network: Regex usage for Event Filters in Log Collector

Issue

The Document  Log Collection: Configure Event Filters for Log Collector has step by step instructions to have Event Filters in Log Collector. However, The regex usage samples may help to apply this configuration for multiple values.

Tasks

Please use below steps for basic Event Filter configuration without Regex.
  1. Navigate to Log Collector->Config->Event Sources page.
  2. From drop-down choose Collection type and Filter.
  3. Click  + under Filters Section to enter Name and Description as below sample.
    filter1
  4. Click  + under Filter Rules Section to enter Rule Description and Rule Conditions as below sample.
    filter2
  5. Then Apply this Filter Configuration for Specific Collection Type by switching From Filter to Config Tab from dropdown. In This Sample Syslog UDP Config used this Event Filter.
    filter3

    This Configuration Stops logging from 10.1.1.1 IP addresses.

Resolution

These steps outline the usage of complex regex for dropping event from a range of IP addresses.

Sample regex: 
filter4
Above regex stops logs from Source IP range 10.1.1.100-10.1.1.199.

More details on IP Regex usage elaborated in  Interpreting Regex for IP range

Product Details

RSA Product Set: NetWitness Logs & Network
RSA Product/Service Type: Core Appliance, Collector
RSA Version/Condition: 10.6.X,11.X
Platform: CentOS
O/S Version: 6,7

Summary

This article outlines the usage of regex feature for IP address in Event Filter configuration of Log Collector.


Approval Reviewer Queue

RSA NetWitness Suite Approval Queue