Enterprise Recon Cloud 2.11.1

Supported Global Filter Types

This section provides a quick reference of Global Filter types.

Types of Global Filter

Filter Type Description
Exclude location by prefix

Exclude search locations and nested locations with paths that begin with a given string. Can be used to exclude entire directory trees.

Example 1

Filter value: C:\Windows\System32

Excludes all files and folders in the "C:\Windows\System32" folder.

Example 2

Filter value: C:\Users\A\Documents\file.zip

Excludes all files and folders nested in the "C:\Users\A\Documents\file.zip" archive.

Exclude location by suffix

Exclude search locations and nested locations with paths that end with a given string.

Example

Filter value: led.jnl

Excludes all files and folders that end with "led.jnl", e.g. "canceled.jnl" and "totaled.jnl".

Exclude locations by expression

Exclude search locations and nested locations that match the given expression. The syntax of the expressions you can use are as follows:

?: A wildcard character that matches exactly one character; ??? matches 3 characters.

*: A wildcard character that matches zero or more characters in a search string.

Example 1

Filter value: C:\V???

All locations where the path starts with "C:\V" followed by any three characters will be excluded during scans. For example, the expressions will exclude "C:\V123", but does not exclude "C:\V1" or "C:\V1234".

Example 2

Filter value: /var/*

All locations in the "/var" directory will be excluded during scans.

Example 3

Filter value: /var/*.txt

All text files with the ".txt" extension in the "/var" directory will be excluded during scans.

Example 4

Filter value: C:\Users\A\Documents\*.zip

All archived files with the ".zip" extension in the "C:\Users\A\Documents" folder will be excluded during scans.

Example 5

Filter value: *.txt

All text files with the ".txt" extension in all locations will be excluded during scans.

You can inverse this filter with a logical NOT operation to only include search locations and nested locations that match the given expression.

!<expression>

Example 1

Filter value: !*.pdf

Only locations with the ".pdf" suffix will be included during scans.

Example 2

Filter value: !C:\Users\*

Only locations where the path starts with "C:\Users\" will be included during scans.

Example 3

Filter value: !C:\Users\A\Documents\*.zip

Only archived files within the "C:\Users\A\Documents" folder will be included during scans.

Example 4

Filter value: !*.txt

Only text files with the ".txt" extension in locations will be included during scans.

Include locations within modification date

Include search locations modified within a given range of dates.

Prompts you to select a start date and an end date. Files and folders that fall outside of the range set by the selected start and end date are not scanned.

Include locations modified recently

Include search locations modified within N number of days from the current date, where the value of N is from 1 - 99 days.

Example

Filter value: 14

Only scan files and folders that have been modified not more than 14 days before the current date.

Exclude locations greater than file size (MB) Exclude files that are larger than a given file size (in MB).
Ignore exact match

Ignore matches that match a given string exactly.

Example

Filter value: 4419123456781234

All exact matches of the pattern "4419123456781234" will be ignored as matches during scans.

Ignore match by prefix

Ignore matches that begin with a given string.

Example

Filter value: 4419

Search ignores matches found during scans that begin with "4419", such as "4419123456781234".

Ignore match by expression

Ignore matches found during scans if they match a given expression.

?: A wildcard character that matches exactly one character; ??? matches 3 characters.

*: A wildcard character that matches zero or more characters in a search string.

Example 1

Filter value: *123

All data patterns that end with "123" will be ignored as matches during scans.

Example 2

Filter value: 123*

All data patterns that begin with "123" will be ignored as matches during scans.

PCRE

To enter a Perl Compatible Regular Expression (PCRE), select Enable full regular expressions support.

Add test data

Report match as test data if it matches a given string exactly.

Example

Filter value: 4419123456781234

All exact matches of "4419123456781234" found during scans will be reported as test data.

Add test data prefix

Report matches that begin with a given string as test data.

Example

Filter value: 4419

Report matches that begin with "4419" as test data, such as "4419123456781234".

Add test data expression

Report matches as test data if they match a given expression. The syntax the of the expressions you can use:

?: A wildcard character that matches exactly one character; ??? matches 3 characters.

*: A wildcard character that matches zero or more characters in a search string.

Example 1

Filter value: *123

All data patterns that end with "123" found during scans will be reported as test data.

Example 2

Filter value: 123*

All data patterns that begin with "123" found during scans will be reported as test data.

To set up Global Filters, refer to the Set Up Global Filters.