What is a one sentence summary of your feature request?
In the NTM Reporting Module we want the ability to conduct a wildcard search under Investigate > Run Query.
Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.
-
In the NTM Reporting Module we want the ability to conduct a wildcard search under Investigate > Run Query.
-
As a specific example for an Active Directory Attribute like “Perpetrator Protocol” we would like to search for rc4 (or using whatever wildcard characters are correct).
How do you currently solve the challenges you have by not having this feature?
+++++
Below are the steps for a current workaround:
+++++
-
Save an investigation in the NTM RM and call it “Perp_Prot_TGS_CIFS_RC4” (for example).
I saved it using the TGS: cifs label and value. -
Run the following query against the PostgreSQL database to locate the investigation that you just created in step 1:
<\*
SELECT p.\*
FROM alert_query_parameters p
JOIN alert_query q ON q.id = p.alert_query_id
where 1=1
and q.name = ‘Perp_Prot_TGS_CIFS_RC4’ << This is my specific name for the Investigation that I created and saved!!!
ORDER BY p.id desc
LIMIT 1;
\*>
- Copy and past the “filters” JSON into a text editor and modify it as follows. (This is my specific example and an example only.)
<\*
\[{“id”: “1”, “operator”: 1, “attribute”: 23, “filterValue”: \[{“value”: 1}\]}, {“id”: “2”, “operator”: 1, “attribute”: 29, “filterValue”: \[{“value”: 1}\]}, {“id”: “3”, “operator”: 3, “attribute”: 18, “filterValue”: \[{“label”: “TGS: cifs”, “value”: “TGS: cifs”}\]}\]
*>
<*
\[{“id”: “1”, “operator”: 1, “attribute”: 23, “filterValue”: \[{“value”: 1}\]}, {“id”: “2”, “operator”: 1, “attribute”: 29, “filterValue”: \[{“value”: 1}\]}, {“id”: “3”, “operator”: 3, “attribute”: 18, “filterValue”: \[{“label”: “rc4”, “value”: “rc4”}\]}\]
\*>
- You must copy and paste your newly created filters JSON value and ID and ALERT_QUERY_ID in order to run the SQL to apply this workaround to your database.
<\*
update alert_query_parameters
set filters = ‘\[{“id”: “1”, “operator”: 1, “attribute”: 23, “filterValue”: \[{“value”: 1}\]}, {“id”: “2”, “operator”: 1, “attribute”: 29, “filterValue”: \[{“value”: 1}\]}, {“id”: “3”, “operator”: 3, “attribute”: 18, “filterValue”: \[{“label”: “rc4”, “value”: “rc4”}\]}\]’
where id =<YOUR_PRECISE_ID> and alert_query_id = <YOUR_PRECISE_ALERT_QUERY_ID>;
\*>
-
Attribute 18 is for perpetrator protocol.
-
Note you will have to restart the NTM Web Service after editing the database.
-
Current work around screenshot is below:
