On Wed, Oct 27, 2010 at 9:22 AM, Brooks Garrett <[email protected]> wrote: > Is anyone currently using the address_match_key_value CDB lookup? I am > trying to use the following: > > <rule id="110102" level="6"> > <if_sid>110100</if_sid> > <list field="srcip" lookup="address_match_key_value" > check_value="^sslvpn">lists/bcexclusions</list> > <description>Host in SSLVPN subnet is bypassing WebProxy</description> > </rule> > > In the list, I have: > 10.17.1.:sslvpn > > And the log decodes: > decoder: 'pix' > id: '6-106100' > action: 'permitted' > proto: 'tcp' > srcip: '10.17.1.12' > srcport: '2175' > dstip: '66.235.138.59' > dstport: '80' > > So given all that, the lookup should run and generate an alert since > the srcip from the log is in the list with a value of sslvpn. Or am I > missing something? > > > Brooks Garrett > E: [email protected] > P: 912.225.4097 > K: 0x13FC3821 (keyserver.ubuntu.com) >
I haven't tried this, but it looks correct to me.
