I'm trying to write a rule to match on a regex, but only if it comes from
certain hosts.
It's easy enough to do this:
<rule id="102001" level="2">
<if_sid>1002</if_sid>
<srcip>10.10.10.10</srcip>
<srcip>10.10.10.20</srcip>
<regex>[\d+]: this is a false positive </regex>
<options>no_email_alert</options>
<description>Don't send email alerts on these bogus false
positives</description>
</rule>
if there's only one or two hosts. But if there are lots of host IPs that
happen to match
a pattern, it gets cumbersome. What' I'd like to do is something like:
<srcip_regex>10.10.1\d.\d0</srcip_regex>
Is there another way to do this?
Dean Takemori
Systems Support Supervisor
TD Food Group
[email protected]
