String Alias support to be retired in SIEM 11.5.1

Technical Articles ID: KB94797
Last Modified: 11/22/2021

Environment

SIEM Enterprise Security Manager (ESM) 11.5.x

Problem

Support is discontinued for string aliases as part of the upcoming improvements to random string management within the SIEM software. The upgrade pre-check tool begins to verify for the use of string aliases before the removal of support so that customers can be notified if they’re currently using string aliases.

System Change

String Aliasing is a filter feature that allows users to specify an alias such as "domain controllers" and then a list of every string that must be matched against the filter "domain controllers."
It allows the users to import and export these lists, which makes it easy to manage large alias lists for user names, host names, and other filter variables.

The feature is deprecated and is discontinued in future releases, starting in 11.5.1.
See the workaround below for possible solutions if this feature is used in your environment.

Workaround

String Normalization Filters and String Aliases were a useful way of filtering dashboard views, but it’s possible to achieve similar function by using filter sets. The main disadvantage is the inability to import or export filter sets such as string aliases allowed:

Click the small gear icon under the Filters section in the upper-right corner of the flash interface.
Select Manage Filters.
Select All Filter Sets.
Click Add Filter Set.
Add the list of filtered items, separated by commas. For instance, a filter set name of "Administrators" might contain a Source User filter with a list of administrator user names such as:

administrator,jrodriguez,user_admin,dc_admin
After the filter set is created, you can use it in the filter sets dialog box at the bottom of the filter section of the dashboards.

Affected Products

SIEM Enterprise Security Manager 11.5.x

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Portuguese Brasileiro

Knowledge Center

String Alias support to be retired in SIEM 11.5.1

Environment

Problem

System Change

Workaround

Affected Products

Languages:

Title

Title

Knowledge Center

String Alias support to be retired in SIEM 11.5.1

Environment

Problem

System Change

Workaround

Affected Products

Languages:

Choose your region

Title

Title