On Wed, Dec 18, 2013 at 10:29 AM, Michael Starks <[email protected]> wrote: > On 2013-12-18 9:21, Chris H wrote: >> >> Thanks, that's kind of what I was expecting. Even same_user, or any of >> the other standard decoder fields might help, as they could be misused >> somewhat. >> >> Thanks for clarifying > > > I think this would be pretty useful. I'll keep it in mind as we work on v3. >
You should create an enhancement ticket: https://bitbucket.org/jbcheng/ossec-hids/issues?status=new&status=open I think this is a really good idea, and would love to see it in 3.0. > > -- > > --- You received this message because you are subscribed to the Google > Groups "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
