Query not working in Custom Alerts but works with LogSearch

[nowel]

Hi, nothings actually wrong with your query its just that not everything in Log Search query can be directly used in the Custom Alert trigger query creation. You need to re-work that one. I got the same issue yesterday. Details as below:

InsightIDR LEQL to RegEx Help Needed

Hi! I tried to create a Dashboard Card and a custom alert notification for my intended use case just that when I try to use my query from the Card in the custom alert it doesn’t actually accept it. And I realized that what am trying to get a custom alert would need a RegEx equivalent. Problem is am really a beginner in RegEx. Would anyone willing to help me on this? Goal: Create a Card representation and a corresponding notification whenever a user shares a file outside of the listed domains …