Adding normalization rules

February 27, 2024

ID 195811

This section explains how to add normalization rules to an event source.

About normalization rules

Normalization rules are used for transforming events. After Kaspersky CyberTrace applies normalization rules to an incoming event, the event is processed using regular expressions.

There are two types of normalization rules:

  • Replacing rules

    Rules for replacing one character sequence with another.

  • Ignoring rules

    Rules for ignoring events that contain a character sequence.

If the replacing rules and ignoring rules are set, replacing rules are applied first and ignoring rules are applied second.

In the specified regular expressions, the asterisk (*) and question mark (?) are not treated as wildcard characters.

Adding normalization rules

Normalization rules tab

Adding normalization rules

To add a normalization rule:

  1. Navigate to the Settings page.
  2. Open the Matching tab.
  3. Locate an event source that must use the new normalization rule. Click Edit (pencil) button. to open source properties.

    The window with the properties of the selected event source opens.

  4. Locate the Normalization rules tab.
  5. Select the Apply normalization rules check box.
  6. If normalization rules are already specified for the event source, add a new entry. Click Add new rule to add extra text boxes for new rule parameters.
  7. Specify rule parameters:
    • For a replacing rule, specify a regular expression in the To replace text box and a replacement in the Replace with text box.
    • For an ignoring rule, specify a regular expression in the Ignore events that contain this text box.
  8. Click the OK button.

Did you find this article helpful?
What can we do better?
Thank you for your feedback! You're helping us improve.
Thank you for your feedback! You're helping us improve.