Question

Usage of process eval like

  • 25 December 2023
  • 0 replies
  • 65 views

Hi guys,

I wrote a query that monitors for abnormal computer names joining my organization network. I had some success with those queries, but they still returns some false positives for me. How can I improve it?

| process eval("is_abnormal_computer_name = (machine != like('Computer_Name') AND machine != like('Computer_Name') AND machine != like('Computer_Name') AND machine != like('Computer_Name'))")

 

| process eval("is_abnormal_computer_name !=  like(machine, '^(name|name|name|name).*')")

 

I want the query to returns the computer names that are abnormal.


0 replies

Be the first to reply!

Reply