How custom types work

Use custom type fields to filter views and reports, and to create custom rules. You can add, edit, or remove custom types, as well as export and import them.

Export or import custom types

You can export custom types to a specific location. Use caution when importing custom types, as they replace current custom types on the system.

When setting up queries for a view, you can use predefined custom types to filter the queries. If no data exists for a specific custom type, the query returns without results. To avoid results like this, select the user field (Custom Field 1 through 10 in the Event Field column of the table) that returns the results that you need instead of using a custom type.

For example, to include source user data in query results, select Source User as a query field. That field acts as a filter and, if the information contains no source user data, the query returns no results. But, if you select User Field 7 (the user field for source user), that field appears as a column in the table of results and doesn't filter the data. If source user data exists, it appears in this column. If no data exists for this field, the User Field 7 column is blank but other columns are populated.

Custom data types

When you select Custom in the Data Type field, you can define the meaning of each field in a multiple field log.

For example, a log (100300.351) contains three fields (100, 300.35, 1). The custom subtype allows you to specify what each of these fields is (integer, decimal, Boolean). For example:

Initial log — 100300.351
3 Subtypes — Integer|decimal|boolean
Custom Subtype — 100|300.35|1

Note
Subtypes can include a maximum of 8 bytes (64 bits) of data. Space Usage displays the number of bytes and bits used. When data exceeds the maximum space, this field indicates, in red, that the space has been exceeded, for example: Space Usage: 9 of 8 bytes, 72 of 64 bits.

If you select the Name/Value Group data type, you can add a custom type that includes a specified group of name/value pairs. You can then filter views and queries by these named pairs, and use them in Internal Event Match alarms.

Characteristics include:

Use a regular expression to filter name/value group fields.
Pairs can be correlated so they are selectable in the Correlation rule editor.
The Advanced Syslog Parser (ASP) collects the values part of the pair.
The maximum size for most custom types is 255 characters. The values exceeding 255 characters are cut off when displaying the information on the field.
Note
Parsing and testing the log on the Policy Editor may handle the full value of custom types, as the limitation is on the UI.
The maximum size for custom types with data type Name/Value Group is 512 characters for all the value pairs, including sub-field names. The values exceeding 512 characters among all value pairs are cut off when displaying the information.
Names must consist of more than 2 characters.
Name/value custom types can have up to 50 names.
Each name in the name/value group appears in the global filter as
```
<name of the group> - <name>
```

Regular expression format for non-indexed custom types

Follow this formatting for non-indexed and indexed string, random string, and hashed string custom types:

Use contains(<regular expression>) syntax or type a value into the non-indexed random string or hashed string fields, then filter custom types.
Use regex() syntax.
With contains(), if you put a comma-separated filter into a non-indexed custom type field (Tom,John,Steve), the system performs a regular expression. The comma and asterisk or a period and asterisk act as a bar (|) in a contains or non-indexed random string or hashed string field. If you type a character such as an asterisk (*), it is replaced with a period followed by the asterisk (.*).
An invalid regular expression or a missing closing or opening parenthesis can cause bad regular expression errors.
You can only use a single regex() or contains() in non-indexed and indexed string, random string, and hashed string custom type filter fields.
Signature ID field accepts contains(<on part or all of a rule message>) and regex(<on part of a rule message>).
A common search filter for contains is a single value, not a single value with a .* before and after.

Search filters include:

Single values
Multiple values separated by commas, which are converted into a regular expression
A contains statement with a * that acts like .*
Advanced regular expressions, where you can use the regex() syntax