...
Each destination can be configured to forward only particular events. The default behaviour behavior for each destination depends on the first filter.
...
If the first filter is set to EXCLUDE, then all events will be sent to the destination, except for those that are specifically excluded by the subsequent filters.
| Info |
|---|
Starting from Snare Central 8.4.0, Destination regular expressions are using RE2 syntax. |
Examples of matches are listed below:
...
| Info | ||
|---|---|---|
| ||
Search for a 'whitespace' character, followed by the text 'myword' followed by another whitespace character, or an end-of-line marker.
|
| Info | ||
|---|---|---|
| ||
It is important to note that any matches are performed on the string in the format in which it arrives at the Reflector and not on the format that it will be translated to when sent to the remote destination. All matches are case sensitive and use PCRE RE2 based regular expression formats (8.4.0 or newer), or PCRE (prior to 8.4.0). |