topic Re: Dynamic group "starts with" in Cortex XDR Discussions

Dynamic group "starts with"

N2Z2 — Tue, 11 Jan 2022 11:55:10 GMT

Hi all,

I need to create a dynamic group based on the first letters of device name, like "starts with" or "not starts with".

I cannot use contains because, for example, I have server name that starts with QQ that should not be inside the group, but servers like ZZQQA01 should be inside.

Is there any way to do this?

Thanks

Re: Dynamic group "starts with"

bbucao — Tue, 11 Jan 2022 15:29:11 GMT

Hi Nicola_Nuzzi,

XDR does support the use of "wildcarding" when defining criteria for a dynamic host group, which would allow you to define the first characters you want to match in the given field followed by "*" which will cause the filter to match anything that starts with those characters.

Examples:

Endpoint Name = QQ* (The filter will match any endpoint whose name starts with "QQ")

Endpoint Name != QQ* (The filter will match all endpoints whose names do NOT start with "QQ")

Please reference step 4 in the documentation linked below for defining criteria for dynamic endpoint groups. Thank you for choosing Cortex XDR!

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/define-endpoint-groups

Re: Dynamic group "starts with"

N2Z2 — Tue, 11 Jan 2022 16:31:18 GMT

Hello,
it turned out to be a silly question ‌‌😐
Thank you!

Re: Dynamic group "starts with"

bbarmanroy — Wed, 12 Jan 2022 07:01:52 GMT

@N2Z2 it is not a silly question! Thank you for raising the question, and thank you @bbucao for answering it. We learn together as a community. 🙂