simple-evcorr-users
Thread
Date
Earlier messages
Messages by Thread
[Simple-evcorr-users] SEC historical home page will close on June 30
Risto Vaarandi
[Simple-evcorr-users] Problem with action2
Tom Damon via Simple-evcorr-users
Re: [Simple-evcorr-users] Problem with action2
Frazier, Jon
Re: [Simple-evcorr-users] Problem with action2
Tom Damon via Simple-evcorr-users
Re: [Simple-evcorr-users] Problem with action2
Frazier, Jon
Re: [Simple-evcorr-users] Problem with action2
Risto Vaarandi
Re: [Simple-evcorr-users] Problem with action2
Tom Damon via Simple-evcorr-users
[Simple-evcorr-users] SEC tutorial has been updated
Risto Vaarandi
[Simple-evcorr-users] Storing a sequence counter in a context
Jim Van Meggelen
Re: [Simple-evcorr-users] Storing a sequence counter in a context
Risto Vaarandi
Re: [Simple-evcorr-users] Storing a sequence counter in a context
Risto Vaarandi
Re: [Simple-evcorr-users] Storing a sequence counter in a context
Jim Van Meggelen
Re: [Simple-evcorr-users] Storing a sequence counter in a context
Risto Vaarandi
Re: [Simple-evcorr-users] Storing a sequence counter in a context
Jim Van Meggelen
Re: [Simple-evcorr-users] Storing a sequence counter in a context
Jim Van Meggelen
Re: [Simple-evcorr-users] Storing a sequence counter in a context
Clayton Dukes
Re: [Simple-evcorr-users] Storing a sequence counter in a context
David Lang
[Simple-evcorr-users] SEC-2.9.2 released
Risto Vaarandi
[Simple-evcorr-users] Duplicate suppression and rearming
Spelta Edoardo
Re: [Simple-evcorr-users] Duplicate suppression and rearming
Risto Vaarandi
[Simple-evcorr-users] R: Duplicate suppression and rearming
Spelta Edoardo
Re: [Simple-evcorr-users] Duplicate suppression and rearming
Risto Vaarandi
Re: [Simple-evcorr-users] Duplicate suppression and rearming
Eric V. Smith via Simple-evcorr-users
[Simple-evcorr-users] R: Duplicate suppression and rearming
Spelta Edoardo
Re: [Simple-evcorr-users] Duplicate suppression and rearming
Risto Vaarandi
[Simple-evcorr-users] R: Duplicate suppression and rearming
Spelta Edoardo
Re: [Simple-evcorr-users] Duplicate suppression and rearming
Risto Vaarandi
[Simple-evcorr-users] R: Duplicate suppression and rearming
Spelta Edoardo
Re: [Simple-evcorr-users] Duplicate suppression and rearming
Risto Vaarandi
[Simple-evcorr-users] SEC tutorial
Risto Vaarandi
Re: [Simple-evcorr-users] SEC tutorial
Jim Van Meggelen
Re: [Simple-evcorr-users] SEC tutorial
Risto Vaarandi
Re: [Simple-evcorr-users] SEC tutorial
Jim Van Meggelen
Re: [Simple-evcorr-users] SEC tutorial
Risto Vaarandi
Re: [Simple-evcorr-users] SEC tutorial
Risto Vaarandi
[Simple-evcorr-users] add string to the event store of a context only if it doesn't exist
Sean Hennessey
Re: [Simple-evcorr-users] add string to the event store of a context only if it doesn't exist
Risto Vaarandi
[Simple-evcorr-users] context w/ input file name embedded
Sean Hennessey
Re: [Simple-evcorr-users] context w/ input file name embedded
Risto Vaarandi
Re: [Simple-evcorr-users] context w/ input file name embedded
Sean Hennessey
Re: [Simple-evcorr-users] context w/ input file name embedded
Risto Vaarandi
[Simple-evcorr-users] new features introduced in SEC-2.9.1
Risto Vaarandi
[Simple-evcorr-users] SEC-2.9.1 released
Risto Vaarandi
[Simple-evcorr-users] Parsing Asterisk log files for downstream reporting - so far so good!
Jim Van Meggelen
Re: [Simple-evcorr-users] Parsing Asterisk log files for downstream reporting - so far so good!
Risto Vaarandi
Re: [Simple-evcorr-users] Parsing Asterisk log files for downstream reporting - so far so good!
Jim Van Meggelen
Re: [Simple-evcorr-users] Parsing Asterisk log files for downstream reporting - so far so good!
Risto Vaarandi
Re: [Simple-evcorr-users] Parsing Asterisk log files for downstream reporting - so far so good!
Jim Van Meggelen
Re: [Simple-evcorr-users] Parsing Asterisk log files for downstream reporting - so far so good!
Risto Vaarandi
Re: [Simple-evcorr-users] Parsing Asterisk log files for downstream reporting - so far so good!
Jim Van Meggelen
Re: [Simple-evcorr-users] Parsing Asterisk log files for downstream reporting - so far so good!
Risto Vaarandi
Re: [Simple-evcorr-users] Parsing Asterisk log files for downstream reporting - so far so good!
Jim Van Meggelen
[Simple-evcorr-users] update in the sec rule repository
Risto Vaarandi
[Simple-evcorr-users] An assist with a rule
James Lay
Re: [Simple-evcorr-users] An assist with a rule
Risto Vaarandi
Re: [Simple-evcorr-users] An assist with a rule
James Lay
Re: [Simple-evcorr-users] An assist with a rule
Risto Vaarandi
[Simple-evcorr-users] reopening inputfile inconsistently fails
Brian Parent via Simple-evcorr-users
Re: [Simple-evcorr-users] reopening inputfile inconsistently fails
Risto Vaarandi
[Simple-evcorr-users] SEC-2.9.0 released
Risto Vaarandi
Re: [Simple-evcorr-users] SEC-2.9.0 released
Jaakko Niemi
Re: [Simple-evcorr-users] SEC-2.9.0 released
Risto Vaarandi
[Simple-evcorr-users] SEC-2.9.alpha2 released
Risto Vaarandi
[Simple-evcorr-users] 20th birthday of SEC
Risto Vaarandi
Re: [Simple-evcorr-users] 20th birthday of SEC
Frazier, Jon
Re: [Simple-evcorr-users] 20th birthday of SEC
Brian Parent via Simple-evcorr-users
Re: [Simple-evcorr-users] 20th birthday of SEC
MILLS, ROCKY
[Simple-evcorr-users] executing multiple actions
Stuart Kendrick
Re: [Simple-evcorr-users] executing multiple actions
Risto Vaarandi
Re: [Simple-evcorr-users] executing multiple actions
Stuart Kendrick
Re: [Simple-evcorr-users] executing multiple actions
Stuart Kendrick
Re: [Simple-evcorr-users] executing multiple actions
Risto Vaarandi
[Simple-evcorr-users] new features in 2.9.alpha1 version
Risto Vaarandi
[Simple-evcorr-users] SEC-2.9.alpha1 released
Risto Vaarandi
[Simple-evcorr-users] Use global variables
Agustín Lara Romero
Re: [Simple-evcorr-users] Use global variables
Risto Vaarandi
[Simple-evcorr-users] How can I trigger all outstanding context actions on SEC_SHUTDOWN?
sec-user--- via Simple-evcorr-users
Re: [Simple-evcorr-users] How can I trigger all outstanding context actions on SEC_SHUTDOWN?
Risto Vaarandi
Re: [Simple-evcorr-users] How can I trigger all outstanding context actions on SEC_SHUTDOWN?
Risto Vaarandi
Re: [Simple-evcorr-users] How can I trigger all outstanding context actions on SEC_SHUTDOWN?
Risto Vaarandi
[Simple-evcorr-users] using variables learned in rule A in rule B's perlfunc: possible?
Michael Hare via Simple-evcorr-users
Re: [Simple-evcorr-users] using variables learned in rule A in rule B's perlfunc: possible?
Risto Vaarandi
Re: [Simple-evcorr-users] using variables learned in rule A in rule B's perlfunc: possible?
Michael Hare via Simple-evcorr-users
Re: [Simple-evcorr-users] using variables learned in rule A in rule B's perlfunc: possible?
Risto Vaarandi
[Simple-evcorr-users] Reset all rules
Agustín Lara Romero
Re: [Simple-evcorr-users] Reset all rules
Risto Vaarandi
[Simple-evcorr-users] Multiple Correlation Question
Suat Toksöz
Re: [Simple-evcorr-users] Multiple Correlation Question
Risto Vaarandi
Re: [Simple-evcorr-users] Multiple Correlation Question
Suat Toksöz
Re: [Simple-evcorr-users] Multiple Correlation Question
Risto Vaarandi
[Simple-evcorr-users] sec-2.8.3 released
Risto Vaarandi
[Simple-evcorr-users] log files existence and accessibility
Richard Ostrochovský
Re: [Simple-evcorr-users] log files existence and accessibility
Risto Vaarandi
Re: [Simple-evcorr-users] log files existence and accessibility
Richard Ostrochovský
Re: [Simple-evcorr-users] log files existence and accessibility
Risto Vaarandi
[Simple-evcorr-users] IP correlation with EventGroup
Agustín Lara Romero
Re: [Simple-evcorr-users] IP correlation with EventGroup
Risto Vaarandi
Re: [Simple-evcorr-users] IP correlation with EventGroup
Agustín Lara Romero
Re: [Simple-evcorr-users] IP correlation with EventGroup
Risto Vaarandi
Re: [Simple-evcorr-users] IP correlation with EventGroup
Agustín Lara Romero
Re: [Simple-evcorr-users] IP correlation with EventGroup
Risto Vaarandi
[Simple-evcorr-users] RV: IP correlation with EventGroup
Agustín Lara Romero
Re: [Simple-evcorr-users] RV: IP correlation with EventGroup
Risto Vaarandi
Re: [Simple-evcorr-users] RV: IP correlation with EventGroup
Risto Vaarandi
Re: [Simple-evcorr-users] RV: IP correlation with EventGroup
John P. Rouillard
Re: [Simple-evcorr-users] RV: IP correlation with EventGroup
Risto Vaarandi
Re: [Simple-evcorr-users] RV: IP correlation with EventGroup
Agustín Lara Romero
[Simple-evcorr-users] SEC CPU utilization
Richard Ostrochovský
Re: [Simple-evcorr-users] SEC CPU utilization
Risto Vaarandi
Re: [Simple-evcorr-users] SEC CPU utilization
Richard Ostrochovský
Re: [Simple-evcorr-users] SEC CPU utilization
David Lang
Re: [Simple-evcorr-users] SEC CPU utilization
Risto Vaarandi
Re: [Simple-evcorr-users] SEC CPU utilization
Risto Vaarandi
Re: [Simple-evcorr-users] SEC CPU utilization
John P. Rouillard
Re: [Simple-evcorr-users] SEC CPU utilization
Risto Vaarandi
Re: [Simple-evcorr-users] SEC CPU utilization
David Lang
Re: [Simple-evcorr-users] SEC CPU utilization
Dusan Sovic
Re: [Simple-evcorr-users] SEC CPU utilization
David Lang
[Simple-evcorr-users] can i add a variable to a pattern?
Martin Etcheverry
Re: [Simple-evcorr-users] can i add a variable to a pattern?
John P. Rouillard
[Simple-evcorr-users] Weirdness parsing for regex
Michael Raugh - NOAA Affiliate via Simple-evcorr-users
Re: [Simple-evcorr-users] Weirdness parsing for regex
Risto Vaarandi
Re: [Simple-evcorr-users] Weirdness parsing for regex
Michael Raugh via Simple-evcorr-users
[Simple-evcorr-users] Interesting command line behaviour
James Lay
Re: [Simple-evcorr-users] Interesting command line behaviour
Risto Vaarandi
Re: [Simple-evcorr-users] Interesting command line behaviour
James Lay
[Simple-evcorr-users] action-list checking if log file is already open by SEC
Richard Ostrochovský
Re: [Simple-evcorr-users] action-list checking if log file is already open by SEC
Risto Vaarandi
Re: [Simple-evcorr-users] action-list checking if log file is already open by SEC
Richard Ostrochovský
Re: [Simple-evcorr-users] action-list checking if log file is already open by SEC
David Lang
Re: [Simple-evcorr-users] action-list checking if log file is already open by SEC
Risto Vaarandi
[Simple-evcorr-users] How to introduce new match variable
Dusan Sovic
Re: [Simple-evcorr-users] How to introduce new match variable
Risto Vaarandi
Re: [Simple-evcorr-users] How to introduce new match variable
Dusan Sovic
[Simple-evcorr-users] pattern matching with .*
Stuart Kendrick
Re: [Simple-evcorr-users] pattern matching with .*
Fulvio Scapin
[Simple-evcorr-users] how not to keep monitored files permanently open (not only) on NFS
Richard Ostrochovský
Re: [Simple-evcorr-users] how not to keep monitored files permanently open (not only) on NFS
Risto Vaarandi
Re: [Simple-evcorr-users] how not to keep monitored files permanently open (not only) on NFS
Richard Ostrochovský
Re: [Simple-evcorr-users] how not to keep monitored files permanently open (not only) on NFS
Richard Ostrochovský
Re: [Simple-evcorr-users] how not to keep monitored files permanently open (not only) on NFS
Risto Vaarandi
[Simple-evcorr-users] SEC rules performance monitoring and tuning
Richard Ostrochovský
Re: [Simple-evcorr-users] SEC rules performance monitoring and tuning
Risto Vaarandi
Re: [Simple-evcorr-users] SEC rules performance monitoring and tuning
Richard Ostrochovský
Re: [Simple-evcorr-users] SEC rules performance monitoring and tuning
Risto Vaarandi
[Simple-evcorr-users] SEC + AI (machine learning)
Richard Ostrochovský
Re: [Simple-evcorr-users] SEC + AI (machine learning)
Risto Vaarandi
Re: [Simple-evcorr-users] SEC + AI (machine learning)
Richard Ostrochovský
[Simple-evcorr-users] using original message in TValue rule action
Richard Ostrochovský
Re: [Simple-evcorr-users] using original message in TValue rule action
Risto Vaarandi
[Simple-evcorr-users] Public Docker image for SEC
Andres Pihlak
Re: [Simple-evcorr-users] Public Docker image for SEC
Alberto Corton Padilla
Re: [Simple-evcorr-users] Public Docker image for SEC
Risto Vaarandi
Re: [Simple-evcorr-users] Public Docker image for SEC
Andres Pihlak
Re: [Simple-evcorr-users] Public Docker image for SEC
Risto Vaarandi
[Simple-evcorr-users] RegExp modifiers
Richard Ostrochovský
Re: [Simple-evcorr-users] RegExp modifiers
Risto Vaarandi
Re: [Simple-evcorr-users] RegExp modifiers
Richard Ostrochovský
Re: [Simple-evcorr-users] RegExp modifiers
Risto Vaarandi
[Simple-evcorr-users] generate SEC configurations automatically
Richard Ostrochovský
Re: [Simple-evcorr-users] generate SEC configurations automatically
John P. Rouillard
Re: [Simple-evcorr-users] generate SEC configurations automatically
Risto Vaarandi
Re: [Simple-evcorr-users] generate SEC configurations automatically
Richard Ostrochovský
Re: [Simple-evcorr-users] generate SEC configurations automatically
Risto Vaarandi
Re: [Simple-evcorr-users] generate SEC configurations automatically
Richard Ostrochovský
[Simple-evcorr-users] "multi-line" and multi-file logs - out of box
Richard Ostrochovský
Re: [Simple-evcorr-users] "multi-line" and multi-file logs - out of box
Risto Vaarandi
Re: [Simple-evcorr-users] "multi-line" and multi-file logs - out of box
Richard Ostrochovský
Re: [Simple-evcorr-users] "multi-line" and multi-file logs - out of box
Risto Vaarandi
Re: [Simple-evcorr-users] "multi-line" and multi-file logs - out of box
Risto Vaarandi
Re: [Simple-evcorr-users] "multi-line" and multi-file logs - out of box
Richard Ostrochovský
[Simple-evcorr-users] Pass variable to second rule - json pattern
Andres Pihlak
Re: [Simple-evcorr-users] Pass variable to second rule - json pattern
Risto Vaarandi
[Simple-evcorr-users] Close input file if there are now events after specified duration
Alberto Corton Padilla
Re: [Simple-evcorr-users] Close input file if there are now events after specified duration
Risto Vaarandi
[Simple-evcorr-users] Accessing A Perl Hash From Pattern1 In Pattern 2
David Thomas
Re: [Simple-evcorr-users] Accessing A Perl Hash From Pattern1 In Pattern 2
MILLS, ROCKY
Re: [Simple-evcorr-users] Accessing A Perl Hash From Pattern1 In Pattern 2
David Thomas
Re: [Simple-evcorr-users] Accessing A Perl Hash From Pattern1 In Pattern 2
MILLS, ROCKY
Re: [Simple-evcorr-users] Accessing A Perl Hash From Pattern1 In Pattern 2
Risto Vaarandi
[Simple-evcorr-users] Maintaining events while modifying rules
David Thomas
Re: [Simple-evcorr-users] Maintaining events while modifying rules
Risto Vaarandi
Re: [Simple-evcorr-users] Maintaining events while modifying rules
David Lang
[Simple-evcorr-users] Help calling perl to get hostname
Clayton Dukes
Re: [Simple-evcorr-users] Help calling perl to get hostname
Risto Vaarandi
Re: [Simple-evcorr-users] Help calling perl to get hostname
Risto Vaarandi
Re: [Simple-evcorr-users] Help calling perl to get hostname
David Thomas
[Simple-evcorr-users] spawn timeout and exit code
Pedro Samarra
Re: [Simple-evcorr-users] spawn timeout and exit code
Risto Vaarandi
Re: [Simple-evcorr-users] spawn timeout and exit code
Risto Vaarandi
[Simple-evcorr-users] EVENTGROUP RULE and match variables
Xinying Sun
Re: [Simple-evcorr-users] EVENTGROUP RULE and match variables
Risto Vaarandi
[Simple-evcorr-users] sec-2.8.2 released
Risto Vaarandi
Re: [Simple-evcorr-users] (no subject)
Santhosh Kumar
Re: [Simple-evcorr-users] (no subject)
David Lang
Re: [Simple-evcorr-users] (no subject)
Risto Vaarandi
Re: [Simple-evcorr-users] (no subject)
Santhosh Kumar
Re: [Simple-evcorr-users] (no subject)
Risto Vaarandi
Re: [Simple-evcorr-users] (no subject)
Santhosh Kumar
Re: [Simple-evcorr-users] (no subject)
Santhosh Kumar
Earlier messages