Hi Team,
When I want to filter by a certain source i find that the hunting rule still triggers on other sources, can someone confirm that they experience the same behaviour when setting up a rule, regex, yara etc. No matter what is selected in - "Refine item tracking by source
Leave this empty to scan items from every source." its alerting on all feeds.
{
"file-name": {},
"decoded": {},
"item": {
"sources": [
"telegram"
]
},
"message": {},
"qrcode": {},
"ocr": {},
"pgp": {},
"title": {}
}
Thanks
Hi Team,
When I want to filter by a certain source i find that the hunting rule still triggers on other sources, can someone confirm that they experience the same behaviour when setting up a rule, regex, yara etc. No matter what is selected in - "Refine item tracking by source
Leave this empty to scan items from every source." its alerting on all feeds.
{
"file-name": {},
"decoded": {},
"item": {
"sources": [
"telegram"
]
},
"message": {},
"qrcode": {},
"ocr": {},
"pgp": {},
"title": {}
}
Thanks