The automatic response might not seem to work as expected in the following scenarios:
- When you create an automatic response with a filter set to evaluate properties of an event with either the Does not contain or Does not equal comparison
- When you use the OR operator
Example filter criteria:
Trigger the event if either of the following applies:
- Threat Name Does not contain 'PatternA'
- Threat Name Does not contain 'PatternB'
A common goal with this filter criteria is to trigger the response for every event unless the threat name contains any of the specified patterns. For example, a threat name of
PatternA or
PatternB might be considered low risk, but common in a given environment. Given this situation, it might be desirable to exclude threats with either of these names.
There's a common misconception that the response evaluates all comparisons as a whole when using the
OR operator. The expected result is that an event with a threat name of
PatternB doesn't trigger this automatic response. It's assumed that it causes one of the comparisons to evaluate to False and can't trigger the response.
Instead, the response evaluates against each of the criteria individually. If any of the comparisons evaluates to True, the entire comparison evaluates to True and the response triggers.
In this example, when an event is received with a threat name of
PatternA, the filter evaluates the event as follows:
- Threat Name Does not contain 'PatternA' = False
- Threat Name Does not contain 'PatternB'=True
Because the threat name doesn't contain PatternB, the entire Threat Name comparison evaluates to
True.
This behavior is expected. Usually, if there are multiple threat names that you do
not want to trigger the response, use the
AND operator as follows:
The event is triggered when the following applies:
- Threat Name Does not contain 'PatternA'
- Threat Name Does not contain 'PatternB'
