Hi, I have a working rule to detect when an AV is stopped and not
started with in the next 60 sec
@Name('Antivirus')@RSAAlert(oneInSeconds=0, identifiers={"host_src"})
SELECT * FROM pattern [ every a = Event( medium = 32 AND device_type =
'av' AND ho...
Hello, I have a cisco ironport esa wich provide the following kind of
log: Jun 06 14:00:07 mail_logs4: Info: MID 62990685 Subject
'=?ISO-8859-1?B?SWYgeW91IGNhbiByZWFkIHRoaXMgeW8=?=\r\n\t=?ISO-8859-2?B?dSB1bmRlcnN0YW5kIHRoZSBleGFtcGxlLg==?=\r\n\t=?ISO...
Hi, I have working ESA rule depending of the time with the following
syntax@Name('OutBusinessHours')create context BusinessHours start (0,
17, *, *, *) end (0, 8, *, *, *);... It works fine but my customers
don't work on saturday and sunday. So, how ...
Hi, I have working ESA rule depending of the time with the following
syntax@Name('BusinessHours')create context BusinessHours start (0, 9, *,
*, *) end (0, 18, *, *, *);... Its works fine but the check is only
based on the arrival time of the log. Ho...
Thanks David Waugh I just check the script parserbook/example
parsers/mal.lua and I found the function:function
mailParser:rfc2047(encodedString) if not encodedString then return end
local decodedString, charset = encodedString, nil -- look for enco...
Thanks David Waugh! It's already the full line (datetime / mailid /
subject): Jun 06 14:00:07 mail_logs4: Info: MID 62990685 Subject
'=?ISO-8859-1?B?SWYgeW91IGNhbiByZWFkIHRoaXMgeW8=?=\r\n\t=?ISO-8859-2?B?dSB1bmRlcnN0YW5kIHRoZSBleGFtcGxlLg==?=\r\n\t=...
But it works on EsperTech Esper EPL Online CREATE schema
Event(event_time long);@Name('Out') select *,(event_time *
1000).format() as event_time_format, (event_time * 1000).toDate () as
event_time_toDate from Event; Event={event_time=1464621180} At:
...
