Creating Tag Rules ( auto tagging ) using Regular Expressions

Creating Tag Rules ( auto tagging ) using Regular Expressions

Realtime Tag rule using Regex :

      A real time tag rule applies tag to only the online assets based on the relevant conditions specified in the tag rule.
       
      You can run these 1st test these using realtime query on assets, if satisfied and returned required results, later we can create a Realtime tag rule for this. 

      Tag assets based on a hostname pattern: 

  1. SELECT 'test-endpoint-tag' AS tag
  2. FROM system_info
  3. WHERE hostname REGEXP '^(Test){1}-\w*-\d{3}$'

     Example hostnames : 

                              Test--121, Test-alpha1-456

      Tag assets based on starting alphabets in hostname : 

  1. SELECT
  2.   'test-a-to-m' as tag
  3. from
  4.   system_info
  5. where
  6.   lower(hostname)  REGEXP '^[a-m].*';
      If you have any error running this realtime query on AIX machines/ realtime query is failing on some error, you can use below query: 
  1.  SELECT
  2. 'test1' as tag
  3. from
  4.   system_info
  5. where
  6.   lower(hostname) like 'a%'
  7.   OR lower(hostname) like 'b%'
  8.   OR lower(hostname) like 'c%'
  9.   OR lower(hostname) like 'd%'
  10.   OR lower(hostname) like 'e%'
  11.   OR lower(hostname) like 'f%'
  12.   OR lower(hostname) like 'g%'
  13.   OR lower(hostname) like 'h%'
  14.   OR lower(hostname) like 'i%'
  15.   OR lower(hostname) like 'j%'
  16.   OR lower(hostname) like 'k%'
  17.   OR lower(hostname) like 'l%'
  18.  OR lower(hostname) like 'm%'

      Example hostnames : 

                              Matches assets with names starting with a to m( or A to M ) alphabets 

Global Tag Rule using Regex :

      A global tag rule applies tag to all the assets present in the global data based on the relevant conditions specified in the tag rule.

      You can run these 1st test these using global query, if satisfied and it returned required results, later we can create a Global tag rule for this.

      Tag assets based on a hostname pattern: 

  1. WITH latest_row AS (
  2.   SELECT hostname,
  3.     upt_asset_id,
  4.     max(upt_time) AS maxtime
  5.   FROM system_info
  6.   WHERE upt_day >= CAST(
  7.       date_format(
  8.         localtimestamp - INTERVAL '3' DAY,
  9.         '%Y%m%d'
  10.       ) AS INTEGER
  11.     )
  12.   GROUP BY hostname,
  13.     upt_asset_id
  14. )
  15. SELECT DISTINCT upt_asset_id,
  16.   'test-endpoint-tag' AS tag
  17. FROM latest_row
  18. WHERE regexp_like(hostname, '^(Test){1}-\w*-\d{3}$')

      Example hostnames : 

                                    Test--121, Test-alpha1-456


    • Related Articles

    • Auto tagging using global query

      This article provides details on how to create auto tag rules using a global query. Currently, auto tagging using a global query can be achieved using API only. GUI based solution will be available in release 77. Global query based auto tag rules can ...

    • Installing OSQuery using Jamf Pro

      Overview This document outlines the procedure on how to install the Uptycs osquery agent on macOS using Jamf. If you are already familiar with Jamf, please use the attached UptycsOsquery.plist and UptycsOsquery.mobileconfig files to setup Uptycs ...

    • Guidelines for SQL Alerts Rules / Events Rules / Scheduled Queries

      Consider time it takes for events / data shows up in the back-end. On Uptycs portal, data should be visible on the backend in less than 6 minutes. Note : 6 min delay is already coded in for :from and :to variables. upt_server_time BETWEEN :from AND ...

    • Installing Uptycs Agent on MacOS using JAMF

      Overview This document outlines the procedure on how to install the Uptycs osquery agent on macOS using JAMF. Procedure  Installation Download the installer. Login to JAMF. You must have a JAMF Plus plan to be able to deploy custom macOS packages     ...

    • Installing Uptycs Protect using Jamf Pro

      Overview This document outlines the procedure on how to install the Uptycs Protect agent on macOS using Jamf. If you are already familiar with Jamf, please use the attached UptycsProtect.plist and UptycsProtect.mobileconfig files to setup Uptycs ...