I need to do a != on a match regex.


CURRENT FILTER/CorRule:
filter(((e.EventName = "Create Object")) AND ((e.InitiatorUserName !=
"server1")) AND ((e.TargetUserName != "fs_mon_zzzacct*")) AND
((e.InitiatorUserName != "server2")))

See, my org creates heartbeat accounts in IDM and tracks them flowing
through different systems.

So, we create 3 new "heartbeat" accounts every minute.

I've been doing sub-rule to simplify.
filter(e.TargetUserName match regex (".*fs_mon_zzzacct*.*"))

whatever I try for AND NOT
I get syntax errors in the CorRule builder

I can't make a dyn list of these users, because the user is created with
a millisecond timestamp as their name.
for ex:
fs_mon_zzzacct_20150820041154.704

tia,

ThomasE


--
terickson
------------------------------------------------------------------------
terickson's Profile: https://forums.netiq.com/member.php?userid=4175
View this thread: https://forums.netiq.com/showthread.php?t=54105