This is good to know, as I’m also guilty of replying and changing the subject line. I’ve never used a threaded view in any mail clients so didn’t know this could be causing a problem for others.
From: [email protected] [mailto:[email protected]] On Behalf Of Kurt Buff Sent: Thursday, April 10, 2014 6:17 PM To: [email protected] Subject: Re: [NTSysADM] Question on those working with SEIM Yes, Z did change subject line on an ongoing thread, and he didn't trim the post. But, it's not the lack of trimming that's at issue. Taking an existing thread, replying to it and changing the subject line - that's hijacking. Those with non-web clients that use the mail headers to keep track of conversation threads will be surprised a bit... New threads should have new posts... It's certainly not a major crime, but perhaps I'm just too old school. Get off my lawn. Kurt On Thu, Apr 10, 2014 at 8:43 AM, Andrew S. Baker <[email protected]<mailto:[email protected]>> wrote: He didn't hijack the thread, Kurt. The subject was changed. He started a new message via a reply, but failed to trim all the excess... No virtual animals were harmed by this activity... ASB http://XeeMe.com/AndrewBaker<http://xeeme.com/AndrewBaker> Providing Virtual CIO Services (IT Operations & Information Security) for the SMB market… On Wed, Apr 9, 2014 at 4:57 PM, Kurt Buff <[email protected]<mailto:[email protected]>> wrote: On Wed, Apr 9, 2014 at 7:48 AM, Ziots, Edward <[email protected]<mailto:[email protected]>> wrote: > I have a question is anyone using Snare Client out there on their > servers/Domain Controllers, to send eventlog files to a SEIM? We are being > asked as a apart of a SIEM implementation to utilize the Snare Client to > send the logs off to a Symantec (LCP (Log collection point). > > Any experiences on this front, since I have not utilized this before. Z, you hijacked a thread. That's a bit uncool... However, yes, I've used the Snare client, and it seems to work just fine. Never had any problems with it. All I do is cast the logs to a syslog server. Don't have an SEIM in-house yet, but I'm working on it. Kurt
