Hi,
I've done a ruleset to pick certain traps from a Cisco switch.
I check the first word (octetstring) of the fourth
variable with the Event Attribute cube. This is the Cisco switch's card
number and port number, in the format of e.g 7/14 (card 7 port 14). The
ruleset works fine but I'd like to check the value using a wildcard. Now
I've
added one Event Attribute cube per port (7/1, 7/2, 7/3 ....) which makes
quite a few cubes
and a messy ruleset. I'd like to pick traps from every port on card nr 7,
like "7/*" if you get
my meaning, and I would end up with only one Event Attribute cube and a
ruleset much
easier to view. Actually I've tried "*" and "?" but it doesn't work.
Any ideas anyone?
Regards
Mans Langert
|