node-pattern-group

Retreives pattern group items synchronized with the control node in the data node. This command is only available in the data node.

Syntax

node-pattern-group [guid=SIG_GUID]
Optional Parameter
guid=SIG_GUID
GUID of the pattern group. If you specify the GUID, the command displays the pattern group information corresponding to the specified GUID. If you do not specify the GUID, the command displays a list of all pattern groups synchronized to the data nodes.

Description

The output fields of when the pattern group GUID is specified are as follows:

FieldTypeDescription
exprStringA boolean combination of keywords for Aho-Corasick multi-pattern matching
expr2StringSecondary inspection expression after expr matching
ruleStringPattern name (name to be tagged in the output when matching)

The output fields of when the pattern group GUID is not specified are as follows:

FieldTypeDescription
idIntegerInteger identifier
guidStringPattern group GUID
nameStringPattern group name
descriptionStringPattern group description
pattern_countIntegerNumber of items in the pattern group
company_guidStringCompany GUID
company_nameStringCompany name
user_nameStringAccount name
user_guidStringAccount GUID

Usage

  1. Load the list of pattern groups synchronized on the data node.

    node-pattern-group
    
  2. Retrieve specific pattern group items synchronized on the data node.

    node-pattern-group guid=b5ce2e95-67b9-4d64-8f6e-2746264a58d2