Indicator matching Rules

Elastic Stack Kibana
1

Hello,

I recently configured an Indicator Matching Rule that creates alarms if any indicator is found. The issue with this is that the indicator are matched partially. For instance if I have the indicator something.q77.eu and a log entry of ecsc2025.eu it results in a match bc "eu" of the indicator is found in the logentry.

Any way to get an exact match?

Best Regards.

1 Like
2

This is due to the way you save the fields in Elasticsearch, they should be saved as a keyword field instead of text. Text analyzes the field and spits it by usual separators like spaces or dots.

3

Elasticsearch is also creating keyword fields for every field in the index. Is it enough to just select they Keyword variant or do I have to keep something else in mind?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.