[Simple-evcorr-users] 10th birthday of SEC
hi all, a small note that might be interesting for some. The first public version of SEC (1.0) was released 10 years ago, in March 23 2001. Few facts about the 1.0 version: - it had 3,059 lines and 75KB of code (in contrast, the latest 2.6.0 version has almost 10,000 lines and 280KB of code) - it supported 7 rule types (Single, SingleWithSuppress, Pair*, SingleWith*Threshold*, Suppress) - 6 actions were implemented (logonly, shellcommand, create, delete, event, reset) - 2 pattern types were supported (regular expressions and substrings) - rules had positional parameters, for example: Single | DontCont | SubStr | this is a test | my event description | logonly I would like to thank all list members for exchanging many interesting ideas which have supported the development of SEC. My special thanks goes to John Rouillard for many creative discussions and for being active in the SEC community for almost a decade :) kind regards, risto -- Enable your software for Intel(R) Active Management Technology to meet the growing manageability and security demands of your customers. Businesses are taking advantage of Intel(R) vPro (TM) technology - will your software be a part of the solution? Download the Intel(R) Manageability Checker today! http://p.sf.net/sfu/intel-dev2devmar ___ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
Re: [Simple-evcorr-users] 10th birthday of SEC
On 03/23/2011 05:25 AM, Risto Vaarandi wrote: > I would like to thank all list members for exchanging many interesting > ideas which have supported the development of SEC. My special thanks > goes to John Rouillard for many creative discussions and for being > active in the SEC community for almost a decade :) And my special thanks to you, Risto. SEC is a gem, and makes my job easier. Eric. -- Enable your software for Intel(R) Active Management Technology to meet the growing manageability and security demands of your customers. Businesses are taking advantage of Intel(R) vPro (TM) technology - will your software be a part of the solution? Download the Intel(R) Manageability Checker today! http://p.sf.net/sfu/intel-dev2devmar ___ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
Re: [Simple-evcorr-users] 10th birthday of SEC
I'll support Eric's comments Risto, your dedication and effort along these years have made our jobs so much easier, and have without a doubt help improve many (if not most) commercial tools out there (even if they don't publicly accept it!!) My deepest admiration for your tool and general work on this very interesting topic! C. On 23 Mar 2011, at 11:15, Eric Smith wrote: > On 03/23/2011 05:25 AM, Risto Vaarandi wrote: >> I would like to thank all list members for exchanging many interesting >> ideas which have supported the development of SEC. My special thanks >> goes to John Rouillard for many creative discussions and for being >> active in the SEC community for almost a decade :) > > And my special thanks to you, Risto. SEC is a gem, and makes my job easier. > > Eric. > > -- > Enable your software for Intel(R) Active Management Technology to meet the > growing manageability and security demands of your customers. Businesses > are taking advantage of Intel(R) vPro (TM) technology - will your software > be a part of the solution? Download the Intel(R) Manageability Checker > today! http://p.sf.net/sfu/intel-dev2devmar > ___ > Simple-evcorr-users mailing list > Simple-evcorr-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users -- Enable your software for Intel(R) Active Management Technology to meet the growing manageability and security demands of your customers. Businesses are taking advantage of Intel(R) vPro (TM) technology - will your software be a part of the solution? Download the Intel(R) Manageability Checker today! http://p.sf.net/sfu/intel-dev2devmar ___ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
Re: [Simple-evcorr-users] 10th birthday of SEC
I to echo Christian and Eric's comments. Risto, you have created a remarkable tool that is very valuable and a blessing to the community. Cheers -Original Message- From: Christian Charette [mailto:rhatu...@gmail.com] Sent: Wednesday, March 23, 2011 7:22 AM To: simple-evcorr-users@lists.sourceforge.net Subject: Re: [Simple-evcorr-users] 10th birthday of SEC I'll support Eric's comments Risto, your dedication and effort along these years have made our jobs so much easier, and have without a doubt help improve many (if not most) commercial tools out there (even if they don't publicly accept it!!) My deepest admiration for your tool and general work on this very interesting topic! C. On 23 Mar 2011, at 11:15, Eric Smith wrote: > On 03/23/2011 05:25 AM, Risto Vaarandi wrote: >> I would like to thank all list members for exchanging many interesting >> ideas which have supported the development of SEC. My special thanks >> goes to John Rouillard for many creative discussions and for being >> active in the SEC community for almost a decade :) > > And my special thanks to you, Risto. SEC is a gem, and makes my job easier. > > Eric. > > -- > Enable your software for Intel(R) Active Management Technology to meet the > growing manageability and security demands of your customers. Businesses > are taking advantage of Intel(R) vPro (TM) technology - will your software > be a part of the solution? Download the Intel(R) Manageability Checker > today! http://p.sf.net/sfu/intel-dev2devmar > ___ > Simple-evcorr-users mailing list > Simple-evcorr-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users -- Enable your software for Intel(R) Active Management Technology to meet the growing manageability and security demands of your customers. Businesses are taking advantage of Intel(R) vPro (TM) technology - will your software be a part of the solution? Download the Intel(R) Manageability Checker today! http://p.sf.net/sfu/intel-dev2devmar ___ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users -- Enable your software for Intel(R) Active Management Technology to meet the growing manageability and security demands of your customers. Businesses are taking advantage of Intel(R) vPro (TM) technology - will your software be a part of the solution? Download the Intel(R) Manageability Checker today! http://p.sf.net/sfu/intel-dev2devmar ___ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
Re: [Simple-evcorr-users] 10th birthday of SEC
Risto, First of all congratulations on the 10th birthday of SEC! It's really growing up now :) Second, please know that it is highly appreciated and a great product that makes my life and that of a lot of colleagues much simpler! On 23-3-2011 10:25, Risto Vaarandi wrote: hi all, a small note that might be interesting for some. The first public version of SEC (1.0) was released 10 years ago, in March 23 2001. Few facts about the 1.0 version: - it had 3,059 lines and 75KB of code (in contrast, the latest 2.6.0 version has almost 10,000 lines and 280KB of code) - it supported 7 rule types (Single, SingleWithSuppress, Pair*, SingleWith*Threshold*, Suppress) - 6 actions were implemented (logonly, shellcommand, create, delete, event, reset) - 2 pattern types were supported (regular expressions and substrings) - rules had positional parameters, for example: Single | DontCont | SubStr | this is a test | my event description | logonly I would like to thank all list members for exchanging many interesting ideas which have supported the development of SEC. My special thanks goes to John Rouillard for many creative discussions and for being active in the SEC community for almost a decade :) kind regards, risto -- Enable your software for Intel(R) Active Management Technology to meet the growing manageability and security demands of your customers. Businesses are taking advantage of Intel(R) vPro (TM) technology - will your software be a part of the solution? Download the Intel(R) Manageability Checker today! http://p.sf.net/sfu/intel-dev2devmar ___ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users smime.p7s Description: S/MIME Cryptographic Signature -- Enable your software for Intel(R) Active Management Technology to meet the growing manageability and security demands of your customers. Businesses are taking advantage of Intel(R) vPro (TM) technology - will your software be a part of the solution? Download the Intel(R) Manageability Checker today! http://p.sf.net/sfu/intel-dev2devmar___ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
Re: [Simple-evcorr-users] 10th birthday of SEC
In message <4d89bc71.10...@seb.ee>, Risto Vaarandi writes: >a small note that might be interesting for some. The first public >version of SEC (1.0) was released 10 years ago, in March 23 2001. > [...] >- rules had positional parameters, for example: >Single | DontCont | SubStr | this is a test | my event description | logonly Wow yeah I remember. But even in that proto state, it let me do analysis that I hadn't been able to do using logsurfer and many other programs. >I would like to thank all list members for exchanging many interesting >ideas which have supported the development of SEC. My special thanks >goes to John Rouillard for many creative discussions and for being >active in the SEC community for almost a decade :) Thank you for the recognition. Kudos for creating and improving a great tool for proactive log analysis. 10 year huh. Well now I need to go find a bottle of Geritol 8-) (http://en.wikipedia.org/wiki/Geritol). -- -- rouilj John Rouillard === My employers don't acknowledge my existence much less my opinions. -- Enable your software for Intel(R) Active Management Technology to meet the growing manageability and security demands of your customers. Businesses are taking advantage of Intel(R) vPro (TM) technology - will your software be a part of the solution? Download the Intel(R) Manageability Checker today! http://p.sf.net/sfu/intel-dev2devmar ___ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
Re: [Simple-evcorr-users] 10th birthday of SEC
Thank you all -- positive feedback from the community is probably one of the best parts of software development :) kind regards, risto On 03/23/2011 04:25 PM, Morris, Christopher wrote: > I to echo Christian and Eric's comments. Risto, you have created a > remarkable tool that is very valuable and a blessing to the community. > > Cheers > > -Original Message- > From: Christian Charette [mailto:rhatu...@gmail.com] > Sent: Wednesday, March 23, 2011 7:22 AM > To: simple-evcorr-users@lists.sourceforge.net > Subject: Re: [Simple-evcorr-users] 10th birthday of SEC > > I'll support Eric's comments Risto, your dedication and effort along these > years have made our jobs so much easier, and have without a doubt help > improve many (if not most) commercial tools out there (even if they don't > publicly accept it!!) > > My deepest admiration for your tool and general work on this very interesting > topic! > > C. > > On 23 Mar 2011, at 11:15, Eric Smith wrote: > >> On 03/23/2011 05:25 AM, Risto Vaarandi wrote: >>> I would like to thank all list members for exchanging many interesting >>> ideas which have supported the development of SEC. My special thanks >>> goes to John Rouillard for many creative discussions and for being >>> active in the SEC community for almost a decade :) >> >> And my special thanks to you, Risto. SEC is a gem, and makes my job easier. >> >> Eric. >> >> -- > On 03/24/2011 03:50 AM, John P. Rouillard wrote: >> >> In message<4d89bc71.10...@seb.ee>, >> Risto Vaarandi writes: >>> a small note that might be interesting for some. The first public >>> version of SEC (1.0) was released 10 years ago, in March 23 2001. >>> [...] >>> - rules had positional parameters, for example: >>> Single | DontCont | SubStr | this is a test | my event description | logonly >> >> Wow yeah I remember. But even in that proto state, it let me do >> analysis that I hadn't been able to do using logsurfer and many other >> programs. >> >>> I would like to thank all list members for exchanging many interesting >>> ideas which have supported the development of SEC. My special thanks >>> goes to John Rouillard for many creative discussions and for being >>> active in the SEC community for almost a decade :) >> >> Thank you for the recognition. Kudos for creating and improving a >> great tool for proactive log analysis. >> >> 10 year huh. Well now I need to go find a bottle of Geritol 8-) >> (http://en.wikipedia.org/wiki/Geritol). >> >> -- >> -- rouilj >> John Rouillard -- Enable your software for Intel(R) Active Management Technology to meet the growing manageability and security demands of your customers. Businesses are taking advantage of Intel(R) vPro (TM) technology - will your software be a part of the solution? Download the Intel(R) Manageability Checker today! http://p.sf.net/sfu/intel-dev2devmar ___ Simple-evcorr-users mailing list Simple-evcorr-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users