https://sourceforge.net/p/ossecdashboard/wiki/Keyword%2520Filtering/Recent changes to Keyword FilteringenWed, 16 Nov 2011 18:17:01 -0000https://sourceforge.net/p/ossecdashboard/wiki/Keyword%2520Filtering/<pre></pre>John LandersWed, 16 Nov 2011 18:17:01 -0000https://sourceforge.net92c9c8926bda15bc621b99e0e9ae7c19ae0677b3https://sourceforge.net/p/ossecdashboard/wiki/Filtering/<b>Filtering</b> The dashboard allows you to filter/search based on keywords or regular expressions. This wiki entry helps to clarify how this process works. <b>1. General Knowledge</b> The code that determines a match is contained in the Alerts class (resources/Classes/Alerts.class.php). The method is this: ~~~~~ <?PHP public function patternMatch() { if( !isset($_GET['myKeywords']) ) return true; if( $_GET['myKeywords'] == null || empty($_GET['myKeywords']) ) return true; $pattern = urldecode($_GET['myKeywords']); // Assume the given pattern is regex if( preg_match('/^\//',$pattern) ) { return preg_match($pattern, $this->_alertGroup . $this->_alertSystemSource . $this->_alertLogSource . $this->_alertRuleID . $this->_alertRuleMsg . $this->_origMsg); } else { return stristr($this->_alertGroup . $this->_alertSystemSource . $this->_alertLogSource . $this->_alertRuleID . $this->_alertRuleMsg . $this->_origMsg, $pattern); } } ?> ~~~~~ The method returns true if the found alert is a match to what we want, and returns false otherwise. As I'm sure you can also see here, this is a pretty simplistic way to do things. I do intend to expand on this in the future. <b>2. Keyword Matching</b> You can type whatever you want in the filter box and a case insensitive string match is applied to all parts of the found alert. If it's a match, you'll see it in your results. <b>3. Regular Expressions</b> Regular expressions are deemed as any keyword entry that begins with a /. The whole entry is evaluated as a pattern given to the PHP preg_match() function. For example: /clamav.*update/i It's important to note that you need to match the preg_match() requirements. Ref: www.php.net/preg_matchJohn LandersWed, 16 Nov 2011 18:16:26 -0000https://sourceforge.netd3197e7b174749c767a6c22591376949d5e5de12