Hi,
I'm trying to customize the behavior of the rule 35051
(squid_rules.xml) in order to not have it fired if someone tries to access
facebook website.
This rule keeps annoying me, because Facebook "like" button is
EVERYWHERE and my proxy server blocks it.
I wrote this piece of rule on my local_rules.xml but with no success.
<rule id="100060" level="0">
<if_sid>35051</if_sid>
<match>.facebook.com/</match>
<description>Squid cache report</description>
</rule>
Does anybody have the same problem? I'm I doing something wrong?
I appreciate any help.
Regards.
ps: I'm using Ossec Server v2.5.1
