Jul 13 18:37:18 collectd[29124]: plugin_dispatch_values:
Invalid value list from plugin sa_livecontent.Jul 13 18:37:18
collectd[29124]: plugin_dispatch_values: Invalid value list
from plugin decoder_livecontent.Jul 13 18:37:18
collectd[29124]: plu...
Designed a SMTP reporting alert to send an email whenever a specific log
message was ingested. The rule basically said msg.id =
'%C4K_CHASSIS-3-MUXBUFFERREADSUPERVISORSELECTIONFAILED'. Which indicates
that a 48 port card was down. The network team wo...
This was intended more as a blog than a question. So basically I have
run into a permissions issue where after "read and write" permissions
were granted to the Analysts role in the reporting app the analysts were
not able to test a rule that they had...
It seems like when this was created it didn't account for the broker and
SA head unit being separate devices. Attached is the SA Network
Architecture and Ports.pdf that I am referring to.
John,Thanks for the reply and additional information, much appreciated.
We do have an ESA, but was thinking that since there was no correlation
involved that I didn't want to use those resources. Do you happen to
know the steps to allows me to create...
Thanks Eric, very cool and helpful! So the use case I am doing, is
levering an ESA rule that is pretty much building a list anytime
powershell.exe is run (not sure if this covers it while run in memory
with say powerpick or something). I simply wante...
I think I found what I was looking for here RSA Security Analytics
Reporting Guide starting on pg 114.There must be some config issue where
the reports app is not able to access the IMDB.
