Using wilcards when filtering alerts by text with spaces

[Carlos-mb]

As @reyesj2 explained here
#12181 (comment)

It's possible to filter alerts using "*" as wildcard but I have not been able to do it when the text has spaces.

I have tried all combinations of quotation marks, single quotes and parentheses but I have not been able.

This works: rule.name: ET*
These don't work:

rule.name: ET CINS*
rule.name: "ET CINS"*
rule.name: "ET CINS*"

and so on

Is there a chance to search all alerts that starts with "ET CINS"?

Thanks!

[dougburks]

Have you tried escaping the space like this?

rule.name:ET\ CINS*

[Carlos-mb]

Thanks for the idea, but it doesn't work.

In fact, I think that, for my purpose, ET* didn't work either, because I have tried it in "Detections" and it returns all rules that contain the texts ET in any part of the name, not just the beginning.

This is the result of ET in Alerts

And this is the result of E* (without T) in Alerts

[dougburks]

Thanks for the idea, but it doesn't work.

In what way does it not work?

I don't have any ET CINS alerts, but here's an equivalent test of ET INFO alerts using rule.name:ET\ INFO* and it appears to be working for me:

You could also get even more strict and use rule.name:ET\ INFO\ * to require a whitespace after INFO:

In fact, I think that, for my purpose, ET* didn't work either, because I have tried it in "Detections" and it returns all rules that contain the texts ET in any part of the name, not just the beginning.

rule.name:ET* should find any rule.name that contains any word that starts with ET.

And this is the result of E* (without T) in Alerts

rule.name:E* should find any rule.name that contains any word that starts with E.

If you want to be more strict and just show Emerging Threats (ET) rules, then you could do rule.name:ET\ *

[Carlos-mb]

You are right.

In the last tests I did I was not including "rule.name:" as I did in at the beginning. If I use rule.name:ET\ INFO* instead of just ET\ INFO*, it works fine.

Thanks!