Hi, list
I wonder wherher it's possible in user-defined signatures in reqular
expressions to cut patterns and diplay them in event details? This
feature is available in Server Sensor: I can specify smth like
'bla-bla-bla {!} bla-bla' and in this case from matched string (foe
example bla-bla-bla ddd bla-bla) 'ddd' will be cut and shown in Event
details. Can I somehow configure in this way Network sensor?
In general, this can be desirable, for example, when you intend to sniff
passwords from HTTP traffic (HTTP_Authentication does not sniff all
variants) and display actual password in event details.
All ideas are welcome.
---
Best regards, Sergey V. Soldatov.
Information security department.
_______________________________________________
ISSForum mailing list
[email protected]
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to [EMAIL PROTECTED]
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
