Best practices

Use a list and refer to it, instead of using arrays repeatedly.

Do not run regular expressions on a large set of search results. Minimize the search results first and then run regular expressions on them.

Be careful with limit 0. It removes all limitations and causes every event to be returned.

Encapsulate all string patterns with single or double quotation marks to help ensure that Trellix Helix accurately interprets the string. For example:

Using spaces and special characters within a rawmsg string pattern can result in inconsistent search results. To avoid this, either encapsulate single words with quotation marks as noted above or use the AND operator between words. For example:

Using : (contains) instead of = (exact match) is recommended for inexperienced users.