Using IsThreat in a rule

Question

I am trying to use "IsThreat" true in a rule. However, it never finds it.

In nDepth, if I do a search for WebTrafficAudit.IsThreat with a parament of * it finds all items.

If I do a search with a parameter of *0* it finds all items

If I do a search with a parameter of *1* it finds nothing

If I do a search with a parameter of *true* it finds nothing

If I do a search with a parameter of true it finds nothing

If I do a search with a parameter of *false* it finds nothing

So how can I use this and what would be the correct parameter for true?

curtisi · Answer

We have template rules that you can check out as well.

zackm · Answer

In Filters/nDepth/Rules, the Threat Intelligence Feed options are (should be) True/False drop down options as such:

I just tested this in my lab with LEM 6.2.0 installed and every section looked the same with the WebTrafficAudit event type used.

-ZackM

Loop1 Systems: SolarWinds Training and Professional Services

* LinkedIN: Loop1 Systems
* Facebook: Loop1 Systems
* Twitter: @Loop1Systems