Hi @madi thank you very much for your fast response.
I selected the text from the dropdown:
I copied the text from the exception and used it to filter, as it was shown on the screenshot in my first post, so it should match exaclty. The text is:
ET POLICY SMB2 NT Create AndX Request For a Powershell .ps1 File
The JSON:
"_source": {
...
},
"rule": {
"name": "ET POLICY SMB2 NT Create AndX Request For a Powershell .ps1 File",
"id": "2025705",
"category": "Potentially Bad Traffic"
}
..
Another question regarding the exceptions, is it planed to support partial match on the exception value? When creating an exception the only options available only allow to filter by the full value, in this case "ET POLICY SMB2 NT Create AndX Request For a Powershell .ps1 File". It would be nice to allow the use of wildcards, for example "ET POLICY SMB2 NT Create AndX Request*".
Rergards!