Environment
- EDR Server: All Supported Versions
- Event Forwarder
Question
Why do the 'highlights' values contain random PREPREPRE and POSTPOSTPOST tags around words?
Answer
- The PREPREPRE/POSTPOSTPOST are tags the Server adds to watchlist events to highlight terms related to the query. These are used for highlighting the event body in an e-mail notification.
- It appears ONLY in the "highlighting" field.
Additional Notes
Multiple alerts may have these values for the same process in different locations depending on each watchlist query that matches on the process
Related Content