Dynamic group "starts with"

[N2Z2]

Hi all,

I need to create a dynamic group based on the first letters of device name, like "starts with" or "not starts with".

I cannot use contains because, for example, I have server name that starts with QQ that should not be inside the group, but servers like ZZQQA01 should be inside.

Is there any way to do this?

Thanks

[bbucao · Accepted solution]

Hi Nicola_Nuzzi,

XDR does support the use of "wildcarding" when defining criteria for a dynamic host group, which would allow you to define the first characters you want to match in the given field followed by "*" which will cause the filter to match anything that starts with those characters.

Examples:

Endpoint Name = QQ* (The filter will match any endpoint whose name starts with "QQ")

Endpoint Name != QQ* (The filter will match all endpoints whose names do NOT start with "QQ")

Please reference step 4 in the documentation linked below for defining criteria for dynamic endpoint groups. Thank you for choosing Cortex XDR!

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/define-en...

[N2Z2]

Hello,
it turned out to be a silly question ‌‌😐
Thank you!

[bbarmanroy]

@N2Z2 it is not a silly question! Thank you for raising the question, and thank you @bbucao for answering it. We learn together as a community. 🙂