XYGATE Merged Audit Reference Manual

XYGATE Merged Audit
®
Reference Manual
Chapter 3. Configuring Filters and the FILTERS File
XYPRO Technology Corporation 43 Proprietary and Confidential
!or …
MOVER_SELECT_BEGIN
PRODUCT = SAFEGUARD
MOVER_SELECT_END
!or …
MOVER_SELECT_BEGIN
PRODUCT = XYGATEUA
MOVER_SELECT_END
MOVER_END
Operators are used to include or exclude records that match the designated selection
criteria.
Operator Followed by
CONTAINS / NOTCONTAIN A string within quotation marks that describe just part of the
contents of a column in the audit record that you want to rule
out or rule in.
LIKE / NOTLIKE A regular expression within quotation marks that will match
the entire contents of a column in the audit record that you
want to rule out or rule in.
= Equal to; must exactly match the contents of the column in
the audit record you want to rule in.
<> Not equal to; must exactly match the contents of the column
in the audit record that you want to rule out.
<
Less than.
<=
Less than or equal to.
>
Greater than.
>=
Greater than or equal to.
Examples of the various operators
AUDIT.OPERATION = VERIFYUSER
AUDIT.OUTCOME <> 3
AUDIT.OPERATION LIKE "(VERIFYUSER|AUTHENTICATE)"
AUDIT.OBJECTNAME NOTLIKE "$SYSTEM\.SYSTEM\.(USERID|USERIDAK|USERIDAX)"
AUDIT.RESULT CONTAINS "Failed Logon count 2 to 3"
AUDIT.RESULT NOTCONTAIN "Last Mod Time"
Whenever you use LIKE and NOTLIKE, you must use regular expression style
wildcarding. You cannot use Guardian style wild cards. Remember, too, that regular
expressions are case sensitive. Refer to the XYGATE Regular Expressions manual for
information about “building” and testing regular expressions. (To get this and other
XYPRO documents, refer to the section “Additional XYPRO Reference Manuals” in
this manual.)
When using CONTAINS and NOTCONTAIN, remember that you must exactly match
the case of the words you are including or excluding to that actually contained in the
audit records. Notice, for example, that "Last Mod Time" is typecase sensitive.