Release 2008.2
12
If the dashes are removed from the pattern, the pattern converts a MAC address
with no separators. If spaces are inserted, the pattern converts a space-separated
MAC address, and so on.
Combining IP Address and Port
Typically an IP address and port are combined in one field, separated by a colon or
a slash. The following example uses multiple capture groups with one pattern:
pattern id="SourceIPColonPort" xmlns=""><!
[CDATA[Source=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):([\d]{1,5})]]></pattern>
<matcher field="SourceIp" order="1" pattern-id="SourceIPColonPort" capture-group="1"
/>
<matcher field="SourcePort" order="1" pattern-id="SourceIPColonPort"
capture-group="2" />
Modifying an Event Category
A device event category may be hard-coded, or the severity needs to be adjusted.
The following example adjusts the severity for a single event type:
<event-match-single event-name="TheEvent" device-event-category="Actual Category"
severity="6" send-identity="UseDSMResults" />
Modifying Multiple Event Categories
The following example is similar to the above single event example, except that
this example matches all event codes starting with
7
and followed by one to five
digits:
<pattern id="EventNameId" xmlns=""><![CDATA[(7\d{1,5})]]></pattern>
<event-match-multiple pattern-id="EventNameId" capture-group-index="1"
device-event-category="Actual Category" severity="6" send-identity="UseDSMResults"/>
Suppressing Identity Change Events
A DSM may unnecessarily send identity change events. The following is two
examples; one is a method of how to suppress identity change events from being
sent from a single event type. The other is a method of how to suppress identity
change events from being sent from a group of events.
// Never send identity for the event with an EventName of “Authen OK”
<event-match-single event-name="Authen OK" device-event-category="ACS" severity="6"
send-identity="OverrideAndNeverSend" />
// Never send any identity for an event with an event name starting with 7, followed
by one to five other digits:
<pattern id="EventNameId" xmlns=""><![CDATA[(7\d{1,5})]]></pattern>
<event-match-multiple pattern-id="EventNameId" capture-group-index="1"
device-event-category="Cisco Firewall" severity="7"
send-identity="OverrideAndNeverSend"/>
