<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div data-marker="__QUOTED_TEXT__"><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000;">Good afternoon, </div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000;"><br data-mce-bogus="1"></div><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000;" data-mce-style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000;"> I am having an issue parsing my log that has backslashes "\" in it. The rules I am writing are getting stuck and telling me the unparsed portion starts with the "\". Also the originial log has 1 "\" but the returned parsed data shows two "\" as such "\ \". Also, I am trying to work with the string-to parameter and am having trouble. I was hoping you could show me a quick and easy example of a log and rule to help me comprehend it. <br><br><div><div>Best regards-</div><br><div>Sam Castellano<br>Security Analyst<br>Quadrant Information Security<br>O: (904)296-9100 x100<br>T: (800) 538-9357 x100<br>E: soc@quadrantsec.com<br><br>Learn more about our managed SIEM <span class="Object" id="OBJ_PREFIX_DWT6664_com_zimbra_url" style="color: #005a95; cursor: pointer;" data-mce-style="color: #005a95; cursor: pointer;"><a href="https://quadrantsec.com/SaganMSSP" target="_blank" style="color: #005a95; text-decoration-line: none; cursor: pointer;" data-mce-style="color: #005a95; text-decoration-line: none; cursor: pointer;">people + product</a></span></div></div></div><br></div></div></body></html>