Global Filters

Global Filters allow you to set up filters to automatically exclude or ignore matches based on the set filter rules.

You can add this by adding a filter from the Global Filter Manager page or through Remediation by marking matches as False Positive or Test Data when remediating matches.

• View Global Filters
• Add a Global Filter
• Import and Export Filters
• Filter Columns in Databases

Permissions

• Global Admin users have full access to all actions for Global Filters.
• System Managers can import or export Global Filters.
• System Managers can add Global Filters that apply to all Targets / Target Groups, or add Global Filters that apply only to Targets / Target Groups to which they have visibility to.

See User Permissions for more information.

View Global Filters

The Global Filters Manager displays a list of filters and the Targets they apply to. Filters created by marking exclusions when taking remedial action will also be displayed here (see Remediation).

Filter the filters displayed using the options in the Filter by… section:

• False Positives > Locations: Locations marked as False Positives.
• False Positives > Matches: Match data marked as False Positives.
• Test Data > Matches: Match data marked as test data.

Add a Global Filter

To add a global filter:

1. Log into the Web Console.

2. Expand the navigation menu, ENTERPRISE RECON .

3. Go to the SCANNING > GLOBAL FILTER MANAGER page.
4. On the top-right corner of the Global Filter Manager page, click +Add.
5. From the drop-down list, select a Filter Type:

   Filter Type	Description
   Exclude location by prefix	Exclude search locations with paths that begin with a given string. Can be used to exclude entire directory trees. For example, exclude all files and folders in the c:\windows\system32 folder.
   Exclude location by suffix	Exclude search locations with paths that end with a given string. For example, entering led.jnl, excludes files and folders such as canceled.jnl, totaled.jnl.
   Exclude locations by expression	Excludes search locations by expression. The syntax the of the expressions you can use are as follows: ?: A wildcard character that matches exactly one character; ??? matches 3 characters. If placed at the end of an expression, also match zero characters. C:\V??? matches C:\V123 and C:\V1, but not C:\V1234. *: A wildcard character that matches zero or more characters in a search string. /directory-name/* matches all files in the directory. /directory-name/*.txt matches all txt files in the directory.
   Include locations within modification date	Include search locations modified within a given range of dates. Prompts you to select a start date and an end date. Files and folders that fall outside of the range set by the selected start and end date are not scanned.
   Include locations modified recently	Include search locations modified within a given number of days from the current date. For example, enter 14 to display files and folders that have been modified not more than 14 days before the current date.
   Exclude locations greater than file size (MB)	Exclude files that are larger than a given file size (in MB).
   Ignore exact match	Ignore matches that match a given string exactly. For example, when you enter 4419123456781234, the search ignores the 4419123456781234 match.
   Ignore match by prefix	Ignore matches that begin with a given string. For example, setting this to 4419 ignores matches found during scans that begin with 4419, such as 4419123456781234.
   Ignore match by expression	Ignore matches found during scans if they match a given expression. ?: A wildcard character that matches exactly one character; ??? matches 3 characters. If placed at the end of an expression, also match zero characters. C:\V??? matches C:\V123 and C:\V1, but not C:\V1234. *: A wildcard character that matches zero or more characters in a search string. *123 matches all expressions that end with 123. 123* matches all expressions that begin with 123. PCRE To enter a Perl Compatible Regular Expression (PCRE), select Enable full regular expressions support.
   Add test data	Report match as test data if it matches a given string exactly. For example, setting this to 4419123456781234 report matches that match the given string 4419123456781234 exactly as test data.
   Add test data prefix	Report matches that begin with a given string as test data. For example, setting this to 4419 report matches that begin with 4419 as test data, such as 4419123456781234.
   Add test data expression	Report matches as test data if they match a given expression. The syntax the of the expressions you can use: ?: A wildcard character that matches exactly one character; ??? matches 3 characters. If placed at the end of an expression, also match zero characters. C:\V??? matches C:\V123 and C:\V1, but not C:\V1234. *: A wildcard character that matches zero or more characters in a search string. *123 matches all expressions that end with 123. 123* matches all expressions that begin with 123.

6. (From ER 2.0.18) In Apply to, select the Target Group and Target the filter applies to.
   
7. Click Ok.

Import and Export Filters

Importing and exporting filters allows you to move filters from one ER2 installation to another. This is also useful if you are upgrading from Data Recon, Card Recon, or are moving from an older installation of ER2.

You can import from or export to the following file formats:

• Portable XML file.
• Spreadsheet (CSV).
• Test File.
• Card Recon Configuration File.

Portable XML File

This section shows how filters are described in XML files.

These XML files follow the following basic rules:

• XML tags are case sensitive.
• Each tag must include the closing tag. For example, <filter>...</filter>.

• The following ASCII characters have a special meaning in XML and have to be replaced by their corresponding XML character entity reference:

  ASCII Character	Description	XML Character Entity Reference
  <	Less-than sign	&lt;
  >	More-than sign	&gt;
  &	Ampersand	&amp;
  '	Apostrophe	&apos;
  "	Double quotation mark	&quot;

  The XML representation of "<User's Email & Login Name>" is written as &quot;&lt;User&apos;s Email &amp; Login Name&gt;&quot;.

The following tags are used in the XML file for global filters:

Filter Types

Example

<filter> <!-- These filters apply to all Targets --> <global> <location-exclude>*.gzip</location-exclude> <location-exclude>*FOOBAR*</location-exclude> <match-test>*@example.com</match-test> <modified-maxsize>2048</modified-maxsize> </global> <!-- These filters apply only to the Group My-Default-Group --> <target> <name>My-Default-Group</name> <modified-between>2018-1-1 - 2018-1-15</modified-between> </target> <!-- These filters apply only to the Target host My-Windows-Machine --> <target> <name>My-Windows-Machine</name> <match-exclude>1234567890</match-exclude> <modified-within>3</modified-within> </target>
</filter>

Filter Columns in Databases

Filter out columns in databases by using the "Exclude location by suffix" filter to specify the columns or tables to exclude from the scan.

Database Index or Primary Keys

Certain tables or columns, such as a database index or primary key, cannot be excluded from a scan. If a filter applied to the scan excludes these tables or columns, the scan will ignore the filter.