Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

OnlyIf macro based on file metadata not working as expected

OnlyIf macro based on file metadata not working as expected

Environment

  • Cb Protection 8.x +

Symptoms

  • OnlyIf macro for a custom rule doesn't match as expected
  • OnlyIf macro is based on one of the file metadata properties
  • A wildcard is used in the macro, for example:
    <onlyif:Manufacturer:MyCompany:*>

Cause

The macros based on file metadata are only valid for specific files.

Wildcards are not currently supported for this use case.

Resolution

When using an OnlyIf macro based on file metadata, the following format needs to be used (specifying a filename):

<onlyif:Manufacturer:MyCompany:c:\Files\filename.msi>

Related Content

Internal reference number:  EA-12195

Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎08-24-2018
Views:
757
Contributors