Hi Expert, Say our ESA condition : ESA_SubAlert_1 : triggered at each
event from App_rule_1ESA_SubAlert_2 : triggered at each event from
App_rule_2ESA_SubAlert_3 : triggered at each event from
App_rule_3ESA_MainAlert : triggered if any of App_rule_1,...
Hi Experts, We are using netwitness version 11.5.2. In the course of our
investigation and working to build use case in Netwitness for Cisco
Sourcefire, i notice that the signature id was generate occasionally
from the log events. We noticed that the...
Hi @JoshRandall , Thank you for the finding, we have quite a number of
signatures that are not able to parse correctly. There are thousands of
signatures from Cisco Sourcefire, does it mean that for every signature
that come in, we will need to add a...
able to parse with sig.idAug 19 01:25:21 SG1-03-IPS-TTT SFNTDROPSG:
Correlation Event: Not Dropped Events/Not Dropped Event - Logging at Thu
Aug 19 01:25:21 2021 UTC: [1:21546:4] "MALWARE-CNC Possible host
infection - excessive DNS queries for .cn" [...
