Open for Voting

Add NOT to boolean logic on groups in filters and rules

I would like to suggest that there should be a better way to filter out events that we don't want to see or to have trigger a rule. Currently, we only have AND | OR for a group, and there is no way to filter out very specific events that belong to a specific group.

I have a bunch of events that keep occurring that I don't want to see, but I don't want to filter out similar events, so I can't just exclude based upon a single alert value such as SourceAccount, DestinationAccount, or Modification.

For example, I would like a rule that would essentially look like this:

UserModifyAttribute NOT ( (UserModifyAttribute.DestinationAccount = Group1) AND (UserModifyAttribute.Modification = *administrators group*) AND (UserModifyAttribue.SourceAccount = ANONYMOUS LOGON) )

There is currently no way to make a rule that is anything close to this in syntax. I can try to work through the boolean logic to do the same thing with only AND and OR operators, but bueing able to use NOT on an expression group would really really help!

FormerIdeaCreator
  • FormerMember
    FormerMember

    I think there is, it's just not clear. When you build a rule that contains an alert, the exists is implied - i.e. for that rule to take place, the UserModifyAttribute alert will exist; by mentioning UserModifyAttribute in the rule, all UserModifyAttribute alerts will be examined for whether that rule applies.

    There is a "not contained in" for groups. Click on the box and toggle it to the X, that's not contained in. So you can say "thing does NOT exist in this group" (i.e. user is not one of my admins in this list/AD group).

    What you want seems to be:

    UserModifyAttribute.DestinationAccount (NOT CONTAINED IN) "Group1"

    AND

    UserModifyAttribute.Modification (NOT EQUAL TO) "*administrators group*"

    AND

    UserModifyAttribute.SourceAccount (NOT EQUAL TO) "ANONYMOUS LOGON"

    In pictures:

    LEM-UserModificationRule.png

    Let me know if that helps. It might just turn this feature request from missing functionality to making it more obvious emoticons_wink.png

SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 195,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.

SolarWinds Customer Success Center Certification Media Vault Link Accounts
About THWACK Blogs For Government Edit Settings Free Tools & Trials
Legal Documents Terms of Use Privacy California Privacy Rights Security Information
©2024 SolarWinds Worldwide, LLC. All Rights Reserved.