Stream Rule - is wildcard possible

[anonymous]

Good day,

I’ve been trying to figure out if there is a way to create a stream rule based on a string within the message body.

I’ve looked through the internet and haven’t been able to find anything.

I’m able to sort my results on the elastic search with wildcard within the message body however for stream rule it appears to be a different set of rules.

I have snort setup to pipe information to our graylog and ultimately I would like to set email alerts on certain information coming from snort.

Please help. thanks.

Johnny

[sachin]

You can use the “contain” filter for your stream rules.

[anonymous]

Hi Sachin,

thanks. Which version of graylog are you using? I don’t have contain as a selection? I’m using graylog 2.0

Cheers,
Johnny

[jochen]

The “contains” condition has been added in Graylog 2.1.2.

Implement "contains" stream rule

[sachin]

Use 2.3
There are many cool enhancements made.

[anonymous]

Thanks,

I’m sold on the idea of new enhancements.

=)