Syslog user-id - Regex ISE ranges

[LCMember1664]

Hi


I have successfully created a syslog regex filter to receive incoming Cisco ISE authentications.  However, I want to filter some log entries based on only receiving from a particular IP address range and exclude some logs with certain characters in the username.


Has anyone successfully created this?

My example would be (these are not my IP addresses or usernames, it's an example only);


Receive log entries for IP range: 123 . 321 . 33-32. 1-254

eg:
123.321.32.12 - OK
123.321.33.10 - OK
123.222.1.2 - filter off
123.321.34.1 - filter off

[I have tried...] - Framed-IP-Address=(123.\.321\.(3[2-3]\.[0-9]{1,3})

----

Username exclude characters in the username, example I want to receive any username except one which has test in it:  domain\test-1234

i.e.
domain\1234 - OK
domain\test-1234 - filter off

---

Thank you

Steve

[efrancis]

LCMember1664

Is your question referring to a process withing Traps (endpoint)?