...
If the first filter is set to EXCLUDE, then all events will be sent to the destination, except for those that are specifically excluded by the subsequent filters.
Some examples Examples of matches are listed below:
| Info | ||
|---|---|---|
| ||
Snare agents transmit the hostname as the first element of the event, followed by a tab. Some options to capture 'myhostname' are shown below. Which option you use, will depend on the format your log source uses to send through events.
|
...
| Info | ||
|---|---|---|
| ||
Search for a 'whitespace' character, followed by the text 'myword' followed by another whitespace character, or an end-of-line marker.
|
| Info | ||
|---|---|---|
| ||
It is important to note that any matches are performed on the string in the format in which it arrives at the Reflector and not on the format that it will be translated to when sent to the remote destination. All matches are case sensitive and use PCRE based regular expression formats. |
...