simple-evcorr-users

Messages by Date

2019/08/26 Re: [Simple-evcorr-users] (no subject) Santhosh Kumar
2019/07/29 Re: [Simple-evcorr-users] spawn timeout and exit code Risto Vaarandi
2019/07/28 [Simple-evcorr-users] spawn timeout and exit code Pedro Samarra
2019/06/28 Re: [Simple-evcorr-users] EVENTGROUP RULE and match variables Risto Vaarandi
2019/06/28 [Simple-evcorr-users] EVENTGROUP RULE and match variables Xinying Sun
2019/06/02 [Simple-evcorr-users] sec-2.8.2 released Risto Vaarandi
2019/05/13 Re: [Simple-evcorr-users] Correlation Upon Aggregation Santhosh Kumar
2019/05/13 Re: [Simple-evcorr-users] Correlation Upon Aggregation Risto Vaarandi
2019/05/13 [Simple-evcorr-users] Correlation Upon Aggregation Santhosh Kumar
2019/03/18 Re: [Simple-evcorr-users] Question on rule James Lay
2019/03/18 Re: [Simple-evcorr-users] Question on rule Risto Vaarandi
2019/03/18 Re: [Simple-evcorr-users] Question on rule James Lay
2019/03/16 Re: [Simple-evcorr-users] Question on rule Risto Vaarandi
2019/03/15 [Simple-evcorr-users] Question on rule James Lay
2019/01/30 [Simple-evcorr-users] an update to sec FAQ Risto Vaarandi
2018/12/20 Re: [Simple-evcorr-users] list of suppress events Risto Vaarandi
2018/12/20 Re: [Simple-evcorr-users] list of suppress events Kagan, Eli
2018/12/18 Re: [Simple-evcorr-users] list of suppress events Risto Vaarandi
2018/12/18 [Simple-evcorr-users] list of suppress events Kagan, Eli
2018/12/06 Re: [Simple-evcorr-users] help Risto Vaarandi
2018/12/05 [Simple-evcorr-users] help Graeme Danielson
2018/11/09 Re: [Simple-evcorr-users] SingleWithThreshold reference current input line Dusan Sovic
2018/11/08 Re: [Simple-evcorr-users] SingleWithThreshold reference current input line Risto Vaarandi
2018/11/08 [Simple-evcorr-users] SingleWithThreshold reference current input line Dusan Sovic
2018/10/14 Re: [Simple-evcorr-users] Suppress rule and continue filed support Dusan Sovic
2018/10/14 Re: [Simple-evcorr-users] Suppress rule and continue filed support Risto Vaarandi
2018/10/12 Re: [Simple-evcorr-users] Suppress rule and continue filed support Risto Vaarandi
2018/10/12 Re: [Simple-evcorr-users] Suppress rule and continue filed support Dusan Sovic
2018/10/12 Re: [Simple-evcorr-users] Suppress rule and continue filed support Risto Vaarandi
2018/10/12 Re: [Simple-evcorr-users] Suppress rule and continue filed support Dusan Sovic
2018/10/11 Re: [Simple-evcorr-users] Suppress rule and continue filed support Risto Vaarandi
2018/10/11 [Simple-evcorr-users] Suppress rule and continue filed support Dusan Sovic
2018/10/03 [Simple-evcorr-users] sec-2.8.1 released Risto Vaarandi
2018/09/06 [Simple-evcorr-users] updates to SEC FAQ Risto Vaarandi
2018/08/30 [Simple-evcorr-users] sec-2.8.0 released Risto Vaarandi
2018/07/11 Re: [Simple-evcorr-users] Whitelisting or Blacklisting S, Santosh
2018/07/10 Re: [Simple-evcorr-users] Whitelisting or Blacklisting Risto Vaarandi
2018/07/10 Re: [Simple-evcorr-users] Accesing nested fields in json logs Alberto Corton
2018/07/10 [Simple-evcorr-users] Whitelisting or Blacklisting S, Santosh
2018/07/09 Re: [Simple-evcorr-users] Accesing nested fields in json logs Risto Vaarandi
2018/07/09 [Simple-evcorr-users] Accesing nested fields in json logs Alberto Corton
2018/06/20 [Simple-evcorr-users] sec-2.8.alpha2 released Risto Vaarandi
2018/06/18 Re: [Simple-evcorr-users] sec-2.8.alpha1 released Alberto Corton
2018/06/17 [Simple-evcorr-users] Ubuntu service file James Lay
2018/06/16 Re: [Simple-evcorr-users] sec-2.8.alpha1 released Risto Vaarandi
2018/06/13 Re: [Simple-evcorr-users] Way to corelate 2 rules with treshold Risto Vaarandi
2018/06/13 Re: [Simple-evcorr-users] Way to corelate 2 rules with treshold Przemysław Orzechowski
2018/06/12 Re: [Simple-evcorr-users] Way to corelate 2 rules with treshold Risto Vaarandi
2018/06/12 [Simple-evcorr-users] Way to corelate 2 rules with treshold Przemysław Orzechowski
2018/06/04 Re: [Simple-evcorr-users] sec-2.8.alpha1 released Risto Vaarandi
2018/06/04 Re: [Simple-evcorr-users] sec-2.8.alpha1 released Alberto Corton
2018/06/04 Re: [Simple-evcorr-users] sec-2.8.alpha1 released Risto Vaarandi
2018/06/04 Re: [Simple-evcorr-users] sec-2.8.alpha1 released Alberto Corton
2018/05/21 [Simple-evcorr-users] sec-2.8.alpha1 released Risto Vaarandi
2018/04/07 Re: [Simple-evcorr-users] keepalive Risto Vaarandi
2018/04/06 [Simple-evcorr-users] keepalive Kagan, Eli
2018/04/04 Re: [Simple-evcorr-users] Storing events of a SingleWithThreshold rule Risto Vaarandi
2018/04/04 [Simple-evcorr-users] Storing events of a SingleWithThreshold rule Alberto Corton
2018/04/04 Re: [Simple-evcorr-users] rule reuse and file splitting Risto Vaarandi
2018/04/03 [Simple-evcorr-users] rule reuse and file splitting Kagan, Eli
2018/04/03 Re: [Simple-evcorr-users] Input log missing in syslog-ng Risto Vaarandi
2018/04/03 Re: [Simple-evcorr-users] Input log missing in syslog-ng Inderjeet Singh
2018/04/03 Re: [Simple-evcorr-users] Input log missing in syslog-ng Risto Vaarandi
2018/04/03 [Simple-evcorr-users] Input log missing in syslog-ng Inderjeet Singh
2018/03/20 Re: [Simple-evcorr-users] design question about dynamic inputs Risto Vaarandi
2018/03/20 Re: [Simple-evcorr-users] design question about dynamic inputs Alberto Corton
2018/03/20 Re: [Simple-evcorr-users] design question about dynamic inputs Risto Vaarandi
2018/03/20 Re: [Simple-evcorr-users] design question about dynamic inputs Alberto Corton
2018/03/19 [Simple-evcorr-users] design question about dynamic inputs Risto Vaarandi
2018/03/12 Re: [Simple-evcorr-users] PairWithWindow rule and timestamp of the first event Riska, Roni (Nokia - FI/Espoo)
2018/03/09 Re: [Simple-evcorr-users] PairWithWindow rule and timestamp of the first event Risto Vaarandi
2018/03/09 [Simple-evcorr-users] PairWithWindow rule and timestamp of the first event Riska, Roni (Nokia - FI/Espoo)
2018/03/08 Re: [Simple-evcorr-users] SEC use cases -> modifying the state of the world Kagan, Eli
2018/03/08 Re: [Simple-evcorr-users] SEC use cases -> modifying the state of the world Risto Vaarandi
2018/03/07 Re: [Simple-evcorr-users] SEC use cases -> modifying the state of the world John P. Rouillard
2018/03/07 [Simple-evcorr-users] SEC use cases -> modifying the state of the world Andrew Nieuwsma
2018/02/13 Re: [Simple-evcorr-users] SEC Reading problem Risto Vaarandi
2018/02/12 Re: [Simple-evcorr-users] SEC Reading problem Jaren Peich
2018/01/31 Re: [Simple-evcorr-users] SEC Reading problem Risto Vaarandi
2018/01/31 Re: [Simple-evcorr-users] SEC Reading problem Jaren Peich
2018/01/29 Re: [Simple-evcorr-users] SEC Reading problem Jaren Peich
2018/01/27 Re: [Simple-evcorr-users] SEC Reading problem Risto Vaarandi
2018/01/26 Re: [Simple-evcorr-users] SEC Reading problem Risto Vaarandi
2018/01/26 Re: [Simple-evcorr-users] SEC Reading problem Andy Smith via Simple-evcorr-users
2018/01/26 Re: [Simple-evcorr-users] SEC Reading problem Risto Vaarandi
2018/01/26 [Simple-evcorr-users] SEC Reading problem Jaren Peich
2018/01/12 Re: [Simple-evcorr-users] Variable set from one rule, to use with action on another rule. Kamil B
2018/01/12 Re: [Simple-evcorr-users] Variable set from one rule, to use with action on another rule. Risto Vaarandi
2018/01/12 [Simple-evcorr-users] Variable set from one rule, to use with action on another rule. Kamil B
2018/01/12 Re: [Simple-evcorr-users] Ignore first n 'bar' if 'foo' occurs Kamil B
2018/01/11 Re: [Simple-evcorr-users] Ignore first n 'bar' if 'foo' occurs Risto Vaarandi
2018/01/11 [Simple-evcorr-users] Ignore first n 'bar' if 'foo' occurs Kamil B
2017/12/12 [Simple-evcorr-users] sec-2.7.12 released Risto Vaarandi
2017/11/21 Re: [Simple-evcorr-users] Get last event in SingleWithThreshold rule Riska, Roni (Nokia - FI/Espoo)
2017/11/21 Re: [Simple-evcorr-users] Get last event in SingleWithThreshold rule Risto Vaarandi
2017/11/21 [Simple-evcorr-users] Get last event in SingleWithThreshold rule Riska, Roni (Nokia - FI/Espoo)
2017/10/27 [Simple-evcorr-users] reading utf16 log files Risto Vaarandi
2017/08/11 Re: [Simple-evcorr-users] Log Rotation Risto Vaarandi
2017/08/11 [Simple-evcorr-users] Log Rotation Joanna Christou
2017/08/08 Re: [Simple-evcorr-users] look-up a string in a hash, then write hash value Stuart Kendrick
2017/08/07 Re: [Simple-evcorr-users] look-up a string in a hash, then write hash value Stuart Kendrick
2017/08/07 Re: [Simple-evcorr-users] look-up a string in a hash, then write hash value Risto Vaarandi
2017/08/07 Re: [Simple-evcorr-users] Help Risto Vaarandi
2017/08/05 Re: [Simple-evcorr-users] look-up a string in a hash, then write hash value Risto Vaarandi
2017/08/04 Re: [Simple-evcorr-users] look-up a string in a hash, then write hash value Stuart Kendrick
2017/08/04 Re: [Simple-evcorr-users] look-up a string in a hash, then write hash value Risto Vaarandi
2017/08/04 Re: [Simple-evcorr-users] Understanding % when creating config file global variables Risto Vaarandi
2017/08/04 Re: [Simple-evcorr-users] look-up a string in a hash, then write hash value Stuart Kendrick
2017/08/04 [Simple-evcorr-users] Understanding % when creating config file global variables Stuart Kendrick
2017/08/03 Re: [Simple-evcorr-users] look-up a string in a hash, then write hash value Risto Vaarandi
2017/08/03 Re: [Simple-evcorr-users] look-up a string in a hash, then write hash value Risto Vaarandi
2017/08/03 Re: [Simple-evcorr-users] look-up a string in a hash, then write hash value Stuart Kendrick
2017/08/03 Re: [Simple-evcorr-users] Help Risto Vaarandi
2017/08/03 [Simple-evcorr-users] Help Joanna Christou
2017/07/26 Re: [Simple-evcorr-users] look-up a string in a hash, then write hash value Jaren Peich
2017/07/25 Re: [Simple-evcorr-users] look-up a string in a hash, then write hash value Risto Vaarandi
2017/07/25 [Simple-evcorr-users] look-up a string in a hash, then write hash value Stuart Kendrick
2017/07/18 Re: [Simple-evcorr-users] SEC_SHUTDOWN event/delay Peter Eckel
2017/07/17 Re: [Simple-evcorr-users] SEC_SHUTDOWN event/delay David Lang
2017/07/17 Re: [Simple-evcorr-users] SEC_SHUTDOWN event/delay Peter Eckel
2017/07/17 Re: [Simple-evcorr-users] SEC_SHUTDOWN event/delay Risto Vaarandi
2017/07/17 Re: [Simple-evcorr-users] SEC_SHUTDOWN event/delay Risto Vaarandi
2017/07/17 Re: [Simple-evcorr-users] SEC_SHUTDOWN event/delay John P. Rouillard
2017/07/17 [Simple-evcorr-users] SEC_SHUTDOWN event/delay Peter Eckel
2017/07/04 Re: [Simple-evcorr-users] Sec Rule problem Jaren Peich
2017/06/14 [Simple-evcorr-users] potential issues with mailing list Risto Vaarandi
2017/06/13 Re: [Simple-evcorr-users] Sec Rule problem Risto Vaarandi
2017/06/13 Re: [Simple-evcorr-users] Sec Rule problem Jaren Peich
2017/06/08 Re: [Simple-evcorr-users] Sec Rule problem Jaren Peich
2017/06/07 Re: [Simple-evcorr-users] Sec Rule problem Risto Vaarandi
2017/06/06 [Simple-evcorr-users] Sec Rule problem Jaren Peich
2017/05/31 [Simple-evcorr-users] integration with systemd (update to SEC FAQ) Risto Vaarandi
2017/04/20 Re: [Simple-evcorr-users] Regexp matching against context names Dusan Sovic
2017/04/20 Re: [Simple-evcorr-users] Regexp matching against context names Risto Vaarandi
2017/04/20 [Simple-evcorr-users] Regexp matching against context names Dusan Sovic
2017/04/14 Re: [Simple-evcorr-users] Sec error (invalid regular expression) James Lay
2017/04/14 Re: [Simple-evcorr-users] Sec error (invalid regular expression) Risto Vaarandi
2017/04/14 [Simple-evcorr-users] Sec error (invalid regular expression) James Lay
2017/03/29 Re: [Simple-evcorr-users] How to mail with a multiline body? Risto Vaarandi
2017/03/29 Re: [Simple-evcorr-users] How to mail with a multiline body? James Lay
2017/03/29 Re: [Simple-evcorr-users] How to mail with a multiline body? Risto Vaarandi
2017/03/28 [Simple-evcorr-users] How to mail with a multiline body? Tom Damon
2017/03/27 Re: [Simple-evcorr-users] Window being ignored Yahoo
2017/03/27 Re: [Simple-evcorr-users] Window being ignored John P. Rouillard
2017/03/27 [Simple-evcorr-users] Window being ignored Yahoo
2017/03/17 Re: [Simple-evcorr-users] Negation James Lay
2017/03/17 Re: [Simple-evcorr-users] Negation Risto Vaarandi
2017/03/17 Re: [Simple-evcorr-users] Negation James Lay
2017/03/17 Re: [Simple-evcorr-users] Negation Risto Vaarandi
2017/03/17 Re: [Simple-evcorr-users] Negation Risto Vaarandi
2017/03/17 Re: [Simple-evcorr-users] Negation James Lay
2017/03/17 Re: [Simple-evcorr-users] Negation Todd M. Hall
2017/03/17 Re: [Simple-evcorr-users] Negation Todd M. Hall
2017/03/17 Re: [Simple-evcorr-users] Negation Risto Vaarandi
2017/03/17 Re: [Simple-evcorr-users] Negation James Lay
2017/03/17 Re: [Simple-evcorr-users] Negation Todd M. Hall
2017/03/17 Re: [Simple-evcorr-users] Negation James Lay
2017/03/17 Re: [Simple-evcorr-users] Negation Todd M. Hall
2017/03/16 Re: [Simple-evcorr-users] Negation James Lay
2017/03/16 Re: [Simple-evcorr-users] Negation John P. Rouillard
2017/03/16 [Simple-evcorr-users] Negation James Lay
2017/02/10 Re: [Simple-evcorr-users] VIM syntax file? James Lay
2017/02/10 Re: [Simple-evcorr-users] VIM syntax file? Alberto Corton
2017/02/10 Re: [Simple-evcorr-users] VIM syntax file? Risto Vaarandi
2017/02/09 Re: [Simple-evcorr-users] VIM syntax file? Alberto Corton
2017/02/09 [Simple-evcorr-users] VIM syntax file? James Lay
2017/02/03 [Simple-evcorr-users] sec-2.7.11 released Risto Vaarandi
2017/01/31 Re: [Simple-evcorr-users] some changes in the next sec release (feedback appreciated) Risto Vaarandi
2017/01/30 Re: [Simple-evcorr-users] some changes in the next sec release (feedback appreciated) David Lang
2017/01/30 Re: [Simple-evcorr-users] some changes in the next sec release (feedback appreciated) James Lay
2017/01/30 [Simple-evcorr-users] some changes in the next sec release (feedback appreciated) Risto Vaarandi
2017/01/15 Re: [Simple-evcorr-users] Test IF correlation operation exist then take action Dusan Sovic
2017/01/15 Re: [Simple-evcorr-users] Test IF correlation operation exist then take action Risto Vaarandi
2017/01/15 [Simple-evcorr-users] Test IF correlation operation exist then take action Dusan Sovic
2017/01/01 Re: [Simple-evcorr-users] Fw: Content of pattern match cache after synthetic event injection Risto Vaarandi
2017/01/01 [Simple-evcorr-users] Fw: Content of pattern match cache after synthetic event injection Dusan Sovic
2016/12/31 Re: [Simple-evcorr-users] Content of pattern match cache after synthetic event injection Risto Vaarandi
2016/12/30 [Simple-evcorr-users] Content of pattern match cache after synthetic event injection Dusan Sovic
2016/12/29 Re: [Simple-evcorr-users] a very dumb issue Risto Vaarandi
2016/12/28 Re: [Simple-evcorr-users] a very dumb issue Risto Vaarandi
2016/12/28 [Simple-evcorr-users] a very dumb issue Martin Etcheverry
2016/12/24 [Simple-evcorr-users] Merry Christmas! Jaren Peich
2016/12/22 Re: [Simple-evcorr-users] problem sending events from rsyslog to sec Risto Vaarandi
2016/12/22 [Simple-evcorr-users] problem sending events from rsyslog to sec Martin Etcheverry
2016/12/20 Re: [Simple-evcorr-users] Variable access lcall Jaren Peich
2016/12/19 Re: [Simple-evcorr-users] trying to create a rule to alarm when the i get one alarm and the cancelation didn´t arrive in 10 minutes Risto Vaarandi
2016/12/19 [Simple-evcorr-users] trying to create a rule to alarm when the i get one alarm and the cancelation didn´t arrive in 10 minutes Martin Etcheverry
2016/12/19 Re: [Simple-evcorr-users] Variable access lcall Risto Vaarandi
2016/12/19 Re: [Simple-evcorr-users] Variable access lcall Jaren Peich
2016/12/19 Re: [Simple-evcorr-users] Variable access lcall Risto Vaarandi
2016/12/19 Re: [Simple-evcorr-users] Variable access lcall Risto Vaarandi
2016/12/19 [Simple-evcorr-users] Variable access lcall Jaren Peich
2016/12/15 Re: [Simple-evcorr-users] From start specific file Risto Vaarandi
2016/12/15 Re: [Simple-evcorr-users] From start specific file Jaren Peich
2016/12/15 Re: [Simple-evcorr-users] From start specific file Risto Vaarandi
2016/12/15 Re: [Simple-evcorr-users] From start specific file Jaren Peich
2016/12/15 Re: [Simple-evcorr-users] (no subject) Jaren Peich
2016/12/15 [Simple-evcorr-users] From start specific file Jaren Peich
2016/12/12 Re: [Simple-evcorr-users] unique login failures Risto Vaarandi
2016/12/12 [Simple-evcorr-users] unique login failures Varun