For querying integer values, how do we search/query negative values ? -u
Upper boundary. For example, tcp.port = 40000-u selects all TCP ports
above 40000.l- Lower boundary. For example, tcp.port = l-40000 selects
all TCP ports below 40000.Documented...
I noticed this time function in a log parser guide, how to know what
timezone to use offset in? UTCUse the UTC (Coordinated Universal Time,
formerly known as Greenwich MeanTime) function to provide a facility to
normalize the time coming from the pay...
How do we properly categorize events with different fields populating
needed information to categorize the event? Sample Log: 2017-09-28
15:14:31.930^^AUDIT^^User Management Service^^samplehost^^Logged in.
User's last login date updated^^themountain@...
Does anyone know how to add a return carriage to the ESA notification
templates? for instance, I want a simple email notification with the
following, but broken up by newlines. time=${time?datetime }
AlertName=${moduleName }SIEMAlertid=${id }
severit...
In the following document, on Determine the Channel Name and Add It to a
Windows Event Source, when adding a specific Channel, does the winrm
only pick up the configured channel added? Or does it continue to pick
up the default , security/system/appl...
thanks eric. how do we tune this within the spectrum appliance? We
shouldn't have to go into and modify tags outside of the appliance just
to tune this. For instance we want to tune out / in
filenames/hashes/extensions from iocs that fire here
Is RSA not going to document diffs in the tool ?When is RSA going to
start using their populated fields to start documenting changes from
previous versions they support ? Using the github adds another layer of
complexity to analyzing parsers.The gith...
When is RSA going to start using their populated fields to start
documenting changes from previous versions they support ?For instance,
look at this screenshot, there are various fields that could be used for
populating needed information for users t...
Is there an ability to integrate cuckoo windows host log data into the
log portion of the SIEM? Specifically analyzing windows logs, and
consuming them into via a log collection method? Interested to see if we
could identify some potential alerting t...
