LIVEcommunity - Who Me Too'd this topic

Is there the way to separate traffic and threat logs from syslog miner to be directed to diferent outputs based on confidence. What i mean is something like that in rules:

conditions:
- type == 'THREAT'
fields:
- misc
- url_idx
indicators:
- src_transalted_ip

attributes:

- confidence == '100'

conditions:
- type == 'TRAFFIC'
fields:
- misc
- url_idx
indicators:
- src_transalted_ip

attributes:

- confidence == '50'

I tried creating 2 different syslog miners with different confidence lvl but only one was working.

Who Me Too'd this topic

L3 Networker

Me Too date:

Unlock your full community experience!

Who Me Too'd this topic

Syslog Miner different confidence values.