CB Response: How to Use Regex Wildcard on Ingress Filters
book
Article ID: 287912
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
How to use Regex wildcard on Ingress Filters
Environment
- Carbon Black Response API: All Versions
Resolution
- Regular Expression: rx|
- Case Insensitive Regular Expression: rxi|.
- In this example we will filter out Google Chrome processes based on the path_filters parameter, ignoring the install drives and case insensitive
curl -XPOST -H "X-AUTH-Token: <API TOKEN HERE> -H "Content-Type: application/json" "https://localhost/api/v1/ingress_whitelist" -k -d '
[
{
"id": "ChromeExample",
"global": true,
"path_filters":[rxi|.*\\\\Program Files\\(x86\\)\\\\Google\\\\Chrome\\\\Application\\\\.*]
}
]'
Additional Information
- Path backslashes need to be converted to four backslashes "\\\\Application"
- Wildcards need to be preceded with a dot asterisks "\\\\.*"
- Paths containing parentheses need to be cancelled out with two backslashes "\\(x86\\)"
Feedback
thumb_up
Yes
thumb_down
No