Dear everyone, I need to filter the Offense from SIEM to SOAR by conditions like pic below.

Triggered condition is (severity > 4 AND description equal to Bruteforce:*).

The problem is that I don't know how to express the operators for "severity" field with the integer format.

May I define simple like ">4" or "\b-?(4|[5-9]|[1-9][0-9]*)\b" (regular expressions) for this case ?

Regards!

------------------------------
Benny On
------------------------------

Hi Benny,

The plug-in supports fnmatch which does not have as much of a wide choice of expressions compared with regex.

Dear Ben,

Thank you for your information,

I have found this documents: "https://www.ibm.com/docs/en/qradar-common?topic=escalations-automatic".

So best practice answer for the "severity" is [5-9]

------------------------------
On Chi Thanh
------------------------------