Hi Risto,
Yes, your suppositions in the points 1, 2 and 3 are correct.
The events can appear in any order.
The expected time window for this events is 60 seconds
Kind regards,
Agustín
Cc: simple-evcorr-users@lists.sourceforge.net
Asunto: Re: [Simple-evcorr-users] IP correlation with
hi Agustin,
Hi Risto,
> My name is Agustín, I'm working with the SEC and I have a problem that I
> can't solve.
> I have different events such as:
> EVENT_TYPE_A FROM 1.1.1.1
> EVENT_TYPE_A FROM 2.2.2.2
> EVENT_TYPE_B FROM 1.1.1.1
> EVENT_TYPE_B FROM 2.2.2.2
> EVENT_TYPE_C FROM 1.1.1.1
>
Hi Risto,
My name is Agustín, I'm working with the SEC and I have a problem that I can't
solve.
I have different events such as:
EVENT_TYPE_A FROM 1.1.1.1
EVENT_TYPE_A FROM 2.2.2.2
EVENT_TYPE_B FROM 1.1.1.1
EVENT_TYPE_B FROM 2.2.2.2
EVENT_TYPE_C FROM 1.1.1.1
EVENT_TYPE_C FROM 2.2.2.2
EVENT_TYPE_D
