Dynamic group "starts with"

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Dynamic group "starts with"

L2 Linker

Hi all,

I need to create a dynamic group based on the first letters of device name, like "starts with" or "not starts with".

I cannot use contains because, for example, I have server name that starts with QQ that should not be inside the group, but servers like ZZQQA01 should be inside.

Is there any way to do this?

Thanks

1 ACCEPTED SOLUTION

Accepted Solutions

L2 Linker

Hi Nicola_Nuzzi,

 

XDR does support the use of "wildcarding" when defining criteria for a dynamic host group, which would allow you to define the first characters you want to match in the given field followed by "*" which will cause the filter to match anything that starts with those characters.

 

Examples:

Endpoint Name = QQ* (The filter will match any endpoint whose name starts with "QQ")

Endpoint Name != QQ* (The filter will match all endpoints whose names do NOT start with "QQ")


Please reference step 4 in the documentation linked below for defining criteria for dynamic endpoint groups. Thank you for choosing Cortex XDR!


https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/define-en...

View solution in original post

3 REPLIES 3

L2 Linker

Hi Nicola_Nuzzi,

 

XDR does support the use of "wildcarding" when defining criteria for a dynamic host group, which would allow you to define the first characters you want to match in the given field followed by "*" which will cause the filter to match anything that starts with those characters.

 

Examples:

Endpoint Name = QQ* (The filter will match any endpoint whose name starts with "QQ")

Endpoint Name != QQ* (The filter will match all endpoints whose names do NOT start with "QQ")


Please reference step 4 in the documentation linked below for defining criteria for dynamic endpoint groups. Thank you for choosing Cortex XDR!


https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/define-en...

L2 Linker

Hello,
it turned out to be a silly question ‌‌😐
Thank you!

@N2Z2 it is not a silly question! Thank you for raising the question, and thank you @bbucao for answering it. We learn together as a community. 🙂

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!