Intruder Help File

Get notified when an alert is triggered.

Expression: Any string value to watch for in the Intruder log file.
Echo: Will echo the found string to the screen if inserted expression string is matched.
Beep: Audio notification when the expression string is met.
Popup Message: Sends a popup message to a screen.
Message Text: Text that will be sent in the popup message.
Workstation: NetBios workstation name on which the popup window will appear.
Email: Will send an email message.
Address: Valid email address to who you want to send the message.
Message: Any string value that will be sent in the email message.

Expression examples.
. - Matches any single character, e.g. "a", "A", "4", ":", or "@". 

? - The preceding character or expression is matched ZERO or ONE times. Either/or. 

+ - The preceding character or expression is matched ONE or MORE times. 

* - The preceding character or expression is matched ZERO or MORE times. 

\ - The "escape" character denotes that the following character should be taken literally. This is used where one of the special characters (e.g. ".") needs to be taken literally and not as a special meta-character. Example: "example\.com", makes sure the period is recognized only as a period (and not expanded to its meta-character meaning of any single character). 

[] - Characters enclosed in brackets will be matched if any of the enclosed characters are encountered. For instance, "[0-9]" matches any numeric digit (zero through nine). As an example, we can combine this with "+" to match any digit one of more times: "[0-9]+". 

() - parentheses are used to group a sub-expression, or multiple sub-expressions 

| - The "bar" character works like an "or" conditional statement. A match is successful if the sub-expression on either side of "|" matches. As an example: "/(this|that) example/" uses grouping and the bar character and would match either "this example" or "that example", and nothing else. 

These are just some of the ones you are likely to use when matching patterns, and is a long way from a definitive list. This is enough to get you started with a few simple examples which may be more illuminating:

Relaying denied|expn

 The field has "Relaying denied|expn". If it matches either pattern in the regular expression, it will send an alert. The first pattern "Relaying denied" is found in trigger, this log is the result of someone attempting an unauthorized mail relay. The pattern "expn" is found in trigger , it is the result of someone attempting to use the expn command.

ad*.example.com
matches "adserver.example.com", "ads.example.com", etc but not "sfads.example.com"

*ad*.example.com
matches all of the above, and then some.

.?pix.com
matches www.ipix.com, pictures.epix.com, a.b.c.d.e.upix.com etc.

www[1-9a-ez].example.c*
matches www1.example.com, www4.example.cc, wwwd.example.cy, wwwz.example.com etc., but not wwww.example.com.

Select the expression you want to edit and click Edit. Only the expression can be edited. Notification type cannot be changed.