topic How to use "name-of-threatid" for threat types like "spyware" in Panorama Discussions

How to use "name-of-threatid" for threat types like "spyware"

Arman_Zaheri — Mon, 22 Jan 2024 13:21:45 GMT

Hello,

I want to filter Panorama Monitoring results based on the field "name-of-threatid" for threat types like "Spyware". But when I click on of the results, I get a filter like this: "... and ( name-of-threatid eq 'Grayware:ZZZZZ.com' )" but when I want to apply this filter I get this error:

It seems this field only accepts numbers. Do you have any idea what should I do about this?

Thank you

Re: How to use "name-of-threatid" for threat types like "spyware"

Rick-Rowe — Thu, 08 Feb 2024 16:59:58 GMT

Add column of 'ID' for the monitor threat logs and then use that spyware ID to filter on.

exa.

'Microsoft Windows NTLMSSP Detection' = ( threatid eq '92322' )

Re: How to use "name-of-threatid" for threat types like "spyware"

Arman_Zaheri — Tue, 02 Apr 2024 09:43:53 GMT

And just a note! This problem is only in Panorama, in Cortex Data Lake it works like a charm!