Looking to do a Regex for a string in full_message I have the first stream rule tagging EventID:4688 (works great)
Trying to then do a second rule where it will match any .exe that ran out of any user appdata folder. For example... (AppData\\Local\\Temp\\.+.exe) works for my powershell queries but not for Graylog. What am I missing here? I have other Regexes working fine, searching for different keywords, but this one eludes me The goal is to tag into the stream any Event 4688 with any exe that ran out of any users appdata\local\temp folder All insight is appreciated Thanks TP -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/6b120e53-90d8-41d7-b3b3-2451a3db9717%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
