simple-evcorr-users  

Messages by Date

• 2010/05/21 Re: [Simple-evcorr-users] My SingleWithThreshold doesn ´t works Risto Vaarandi
• 2010/05/21 Re: [Simple-evcorr-users] My SingleWithThreshold doesn ´t works John P. Rouillard
• 2010/05/21 Re: [Simple-evcorr-users] My SingleWithThreshold doesn ´t works Risto Vaarandi
• 2010/05/21 Re: [Simple-evcorr-users] My SingleWithThreshold doesn ´t works Bufalo
• 2010/05/21 Re: [Simple-evcorr-users] My SingleWithThreshold doesn ´t works Alberto Losada
• 2010/05/21 Re: [Simple-evcorr-users] My SingleWithThreshold doesn ´t works Bufalo
• 2010/05/21 Re: [Simple-evcorr-users] My SingleWithThreshold doesn ´t works Alberto Losada
• 2010/05/21 [Simple-evcorr-users] My SingleWithThreshold doesn ´t works Bufalo
• 2010/05/18 Re: [Simple-evcorr-users] how can I have something run once at startup? david
• 2010/05/18 Re: [Simple-evcorr-users] how can I have something run once at startup? John P. Rouillard
• 2010/05/18 [Simple-evcorr-users] how can I have something run once at startup? david
• 2010/05/18 Re: [Simple-evcorr-users] correlate from a log or from a trap.. what's better? Risto Vaarandi
• 2010/05/18 [Simple-evcorr-users] correlate from a log or from a trap.. what's better? Bufalo
• 2010/05/03 Re: [Simple-evcorr-users] How To Implement Minimum Thresholds? Sven Leupold
• 2010/05/03 Re: [Simple-evcorr-users] Fw: Complex rule ? Any idea ? Pierre Vigneras
• 2010/05/03 Re: [Simple-evcorr-users] Problem with too much files to be checked Risto Vaarandi
• 2010/05/03 Re: [Simple-evcorr-users] Problem with too much files to be checked Risto Vaarandi
• 2010/05/03 [Simple-evcorr-users] Problem with too much files to be checked Gonzalo Rodrigo Sancho
• 2010/04/30 Re: [Simple-evcorr-users] How To Implement Minimum Thresholds? Risto Vaarandi
• 2010/04/30 Re: [Simple-evcorr-users] How To Implement Minimum Thresholds? Risto Vaarandi
• 2010/04/30 Re: [Simple-evcorr-users] How To Implement Minimum Thresholds? John P. Rouillard
• 2010/04/30 Re: [Simple-evcorr-users] How To Implement Minimum Thresholds? Sven Leupold
• 2010/04/30 Re: [Simple-evcorr-users] How To Implement Minimum Thresholds? John P. Rouillard
• 2010/04/30 Re: [Simple-evcorr-users] How To Implement Minimum Thresholds? Sven Leupold
• 2010/04/30 Re: [Simple-evcorr-users] How To Implement Minimum Thresholds? Risto Vaarandi
• 2010/04/30 Re: [Simple-evcorr-users] consulting/professional services Risto Vaarandi
• 2010/04/30 [Simple-evcorr-users] How To Implement Minimum Thresholds? Sven Leupold
• 2010/04/29 [Simple-evcorr-users] consulting/professional services david
• 2010/04/28 Re: [Simple-evcorr-users] embed a newline in action=pipe data (corrected) Risto Vaarandi
• 2010/04/27 Re: [Simple-evcorr-users] embed a newline in action=pipe data (corrected) Ronald San Juan
• 2010/03/26 Re: [Simple-evcorr-users] action=write and dynamic filename Brian Landers
• 2010/03/26 Re: [Simple-evcorr-users] action=write and dynamic filename Brian Landers
• 2010/03/26 Re: [Simple-evcorr-users] embed a newline in action=pipe data (corrected) John P. Rouillard
• 2010/03/26 Re: [Simple-evcorr-users] action=write and dynamic filename John P. Rouillard
• 2010/03/26 [Simple-evcorr-users] action=write and dynamic filename Brian Landers
• 2010/03/25 Re: [Simple-evcorr-users] embed a newline in action=pipe data John P. Rouillard
• 2010/03/25 [Simple-evcorr-users] embed a newline in action=pipe data Danielson, Graeme
• 2010/03/22 Re: [Simple-evcorr-users] How to compare a numer in a pattern John P. Rouillard
• 2010/03/22 [Simple-evcorr-users] How to compare a numer in a pattern smartina
• 2010/03/22 Re: [Simple-evcorr-users] [SEC.PL] Log rotation Risto Vaarandi
• 2010/03/19 [Simple-evcorr-users] [SEC.PL] Log rotation antonin mora
• 2010/03/17 Re: [Simple-evcorr-users] can i let SEC monitor multiple log files? Risto Vaarandi
• 2010/03/16 Re: [Simple-evcorr-users] can i let SEC monitor multiple log files? fedora fedora
• 2010/03/16 Re: [Simple-evcorr-users] can i let SEC monitor multiple log files? Risto Vaarandi
• 2010/03/16 [Simple-evcorr-users] can i let SEC monitor multiple log files? fedora fedora
• 2010/03/02 Re: [Simple-evcorr-users] -detach should allow specifying a directory Risto Vaarandi
• 2010/02/19 [Simple-evcorr-users] -detach should allow specifying a directory John P. Rouillard
• 2010/02/02 Re: [Simple-evcorr-users] Fw: Complex rule ? Any idea ? Risto Vaarandi
• 2010/02/02 Re: [Simple-evcorr-users] Fw: Complex rule ? Any idea ? Risto Vaarandi
• 2010/02/02 Re: [Simple-evcorr-users] Fw: Complex rule ? Any idea ? Peter Wolfenden
• 2010/02/02 Re: [Simple-evcorr-users] Fw: Complex rule ? Any idea ? Pierre Vigneras
• 2010/01/31 [Simple-evcorr-users] Naming variables in regexp patterns John P. Rouillard
• 2010/01/29 Re: [Simple-evcorr-users] Fw: Complex rule ? Any idea ? Risto Vaarandi
• 2010/01/25 Re: [Simple-evcorr-users] [SEC.PL] Using singleWithThreshold John P. Rouillard
• 2010/01/25 Re: [Simple-evcorr-users] [SEC.PL] Reading in an activeMQ file John P. Rouillard
• 2010/01/25 [Simple-evcorr-users] [SEC.PL] Using singleWithThreshold antonin mora
• 2010/01/25 [Simple-evcorr-users] [SEC.PL] Reading in an activeMQ file antonin mora
• 2010/01/25 Re: [Simple-evcorr-users] [SEC] crashes with SingleWithThreshold rule antonin mora
• 2010/01/20 Re: [Simple-evcorr-users] Fw: Complex rule ? Any idea ? Pierre Vigneras
• 2010/01/20 [Simple-evcorr-users] Fw: Complex rule ? Any idea ? Risto Vaarandi
• 2010/01/18 [Simple-evcorr-users] feature request. Tim Peiffer
• 2010/01/18 [Simple-evcorr-users] Using SEC to report on itself? Tim Peiffer
• 2010/01/18 Re: [Simple-evcorr-users] [SEC] crashes with SingleWithThreshold rule John P. Rouillard
• 2010/01/18 Re: [Simple-evcorr-users] [SEC] crashes with SingleWithThreshold rule Risto Vaarandi
• 2010/01/18 [Simple-evcorr-users] [SEC] crashes with SingleWithThreshold rule antonin mora
• 2009/12/28 Re: [Simple-evcorr-users] Working examples Thomas Wollner
• 2009/12/28 [Simple-evcorr-users] Working examples mouse
• 2009/12/15 Re: [Simple-evcorr-users] help Alberto Losada
• 2009/12/11 Re: [Simple-evcorr-users] help Cedrick Kim
• 2009/12/11 Re: [Simple-evcorr-users] help Risto Vaarandi
• 2009/12/10 Re: [Simple-evcorr-users] help John P. Rouillard
• 2009/12/10 [Simple-evcorr-users] help Cedrick Kim
• 2009/12/10 [Simple-evcorr-users] SEC-2.5.3 released Risto Vaarandi
• 2009/12/09 Re: [Simple-evcorr-users] Scheduling context creation? Risto Vaarandi
• 2009/12/09 Re: [Simple-evcorr-users] Scheduling context creation? John P. Rouillard
• 2009/12/09 Re: [Simple-evcorr-users] Scheduling context creation? Tim Peiffer
• 2009/12/09 Re: [Simple-evcorr-users] Scheduling context creation? Risto Vaarandi
• 2009/12/09 Re: [Simple-evcorr-users] Scheduling context creation? Risto Vaarandi
• 2009/12/03 [Simple-evcorr-users] Scheduling context creation? Tim Peiffer
• 2009/12/02 Re: [Simple-evcorr-users] SEC: documentation about state-awareness after reloading ist configuration file? John P. Rouillard
• 2009/12/02 Re: [Simple-evcorr-users] SEC: documentation about state-awareness after reloading ist configuration file? Schmid, Christof
• 2009/12/02 Re: [Simple-evcorr-users] [Bug if action is not knowned] antonin mora
• 2009/12/02 Re: [Simple-evcorr-users] SEC: documentation about state-awareness after reloading ist configuration file? Risto Vaarandi
• 2009/12/02 Re: [Simple-evcorr-users] [SEC.PL] Context limitation Risto Vaarandi
• 2009/12/02 Re: [Simple-evcorr-users] [Bug if action is not knowned] Risto Vaarandi
• 2009/12/02 [Simple-evcorr-users] [Bug if action is not knowned] antonin mora
• 2009/12/01 [Simple-evcorr-users] SEC: documentation about state-awareness after reloading ist configuration file? Schmid, Christof
• 2009/12/01 [Simple-evcorr-users] [SEC.PL] Context limitation antonin mora
• 2009/12/01 Re: [Simple-evcorr-users] get value in a context antonin mora
• 2009/11/30 Re: [Simple-evcorr-users] SEC: limited number of characters in input stream? Risto Vaarandi
• 2009/11/30 Re: [Simple-evcorr-users] SEC: limited number of characters in input stream? Schmid, Christof
• 2009/11/30 Re: [Simple-evcorr-users] SEC: limited number of characters in input stream? Risto Vaarandi
• 2009/11/30 Re: [Simple-evcorr-users] SEC: limited number of characters in input stream? Schmid, Christof
• 2009/11/30 Re: [Simple-evcorr-users] SEC: limited number of characters in input stream? Risto Vaarandi
• 2009/11/29 Re: [Simple-evcorr-users] Correlation rules based on time and paired events Smolecki, Art (OET)
• 2009/11/29 Re: [Simple-evcorr-users] Correlation rules based on time and paired events John P. Rouillard
• 2009/11/29 [Simple-evcorr-users] Correlation rules based on time and paired events Smolecki, Art (OET)
• 2009/11/28 Re: [Simple-evcorr-users] get value in a context John P. Rouillard
• 2009/11/28 [Simple-evcorr-users] get value in a context antonin mora
• 2009/11/26 [Simple-evcorr-users] issues with the SEC mirror site at Estonian Telecom Risto Vaarandi
• 2009/11/24 Re: [Simple-evcorr-users] How best to handle dates in input file names Risto Vaarandi
• 2009/11/24 Re: [Simple-evcorr-users] How best to handle dates in input file names Mike Rykowski
• 2009/11/24 Re: [Simple-evcorr-users] How best to handle dates in input file names Mikel Altuna
• 2009/11/24 Re: [Simple-evcorr-users] How best to handle dates in input file names John P. Rouillard
• 2009/11/24 [Simple-evcorr-users] How best to handle dates in input file names Mike Rykowski
• 2009/11/21 Re: [Simple-evcorr-users] how can you put a newline in a context body? Risto Vaarandi
• 2009/11/20 Re: [Simple-evcorr-users] how can you put a newline in a context body? John P. Rouillard
• 2009/11/20 Re: [Simple-evcorr-users] how can you put a newline in a context body? david
• 2009/11/20 Re: [Simple-evcorr-users] how can you put a newline in a context body? Garret Heaton
• 2009/11/20 Re: [Simple-evcorr-users] how can you put a newline in a context body? Garret Heaton
• 2009/11/20 Re: [Simple-evcorr-users] how can you put a newline in a context body? John P. Rouillard
• 2009/11/19 [Simple-evcorr-users] how can you put a newline in a context body? david
• 2009/11/03 Re: [Simple-evcorr-users] every N minute calendar actions Risto Vaarandi
• 2009/11/03 Re: [Simple-evcorr-users] every N minute calendar actions Risto Vaarandi
• 2009/11/02 [Simple-evcorr-users] every N minute calendar actions Joe Prosser
• 2009/10/30 Re: [Simple-evcorr-users] SEC not reading lines over 1024 in length Ronald San Juan
• 2009/10/28 [Simple-evcorr-users] Anybody going to LISA 09? John P. Rouillard
• 2009/10/26 Re: [Simple-evcorr-users] SEC not reading lines over 1024 in length Ronald San Juan
• 2009/10/26 Re: [Simple-evcorr-users] SEC not reading lines over 1024 in length Risto Vaarandi
• 2009/10/24 Re: [Simple-evcorr-users] Condensing syslog events david
• 2009/10/24 Re: [Simple-evcorr-users] SEC not reading lines over 1024 in length david
• 2009/10/24 Re: [Simple-evcorr-users] SEC not reading lines over 1024 in length John P. Rouillard
• 2009/10/24 Re: [Simple-evcorr-users] SEC not reading lines over 1024 in length John P. Rouillard
• 2009/10/24 Re: [Simple-evcorr-users] SEC not reading lines over 1024 in length Clayton Dukes
• 2009/10/24 Re: [Simple-evcorr-users] Condensing syslog events Clayton Dukes
• 2009/10/24 Re: [Simple-evcorr-users] Condensing syslog events J Carvalho
• 2009/10/23 Re: [Simple-evcorr-users] Condensing syslog events Clayton Dukes
• 2009/10/23 Re: [Simple-evcorr-users] Condensing syslog events J Carvalho
• 2009/10/23 [Simple-evcorr-users] SEC not reading lines over 1024 in length Ronald San Juan
• 2009/10/22 Re: [Simple-evcorr-users] Condensing syslog events J Carvalho
• 2009/10/22 Re: [Simple-evcorr-users] Condensing syslog events david
• 2009/10/22 Re: [Simple-evcorr-users] Condensing syslog events david
• 2009/10/22 Re: [Simple-evcorr-users] Condensing syslog events John P. Rouillard
• 2009/10/22 Re: [Simple-evcorr-users] Condensing syslog events Clayton Dukes
• 2009/10/22 Re: [Simple-evcorr-users] Condensing syslog events John P. Rouillard
• 2009/10/22 Re: [Simple-evcorr-users] Condensing syslog events Clayton Dukes
• 2009/10/22 Re: [Simple-evcorr-users] Condensing syslog events John P. Rouillard
• 2009/10/22 [Simple-evcorr-users] Condensing syslog events J Carvalho
• 2009/10/15 Re: [Simple-evcorr-users] context= =( abs(%u - $3) > 450 ) Doesn't work. Shouldn't it? John P. Rouillard
• 2009/10/15 [Simple-evcorr-users] context= =( abs(%u - $3) > 450 ) Doesn't work. Shouldn't it? Joe Prosser
• 2009/10/07 [Simple-evcorr-users] Sudo questions Jeff Schroeder
• 2009/10/07 Re: [Simple-evcorr-users] Problem using SingleWithThreshold Jeff Schroeder
• 2009/10/07 Re: [Simple-evcorr-users] Problem using SingleWithThreshold Risto Vaarandi
• 2009/10/07 Re: [Simple-evcorr-users] Problem using SingleWithThreshold Jeff Schroeder
• 2009/10/07 Re: [Simple-evcorr-users] Problem using SingleWithThreshold Risto Vaarandi
• 2009/10/07 Re: [Simple-evcorr-users] Accessing the age of a context Risto Vaarandi
• 2009/10/06 [Simple-evcorr-users] Problem using SingleWithThreshold Jeff Schroeder
• 2009/10/05 Re: [Simple-evcorr-users] Accessing the age of a context Joe Prosser
• 2009/10/05 [Simple-evcorr-users] Accessing the age of a context Joe Prosser
• 2009/09/23 [Simple-evcorr-users] SEC mailing list has a search option Risto Vaarandi
• 2009/09/23 Re: [Simple-evcorr-users] SimpleWithSupress Risto Vaarandi
• 2009/09/23 [Simple-evcorr-users] Poll: a change in the 'set' action semantics Risto Vaarandi
• 2009/09/22 [Simple-evcorr-users] SimpleWithSupress Roger Warner
• 2009/09/22 Re: [Simple-evcorr-users] How to report yourself Risto Vaarandi
• 2009/09/21 [Simple-evcorr-users] introducing licensing for rulesets Risto Vaarandi
• 2009/09/10 [Simple-evcorr-users] How to report yourself John P. Rouillard
• 2009/08/16 Re: [Simple-evcorr-users] Count and report suppressed events Risto Vaarandi
• 2009/08/12 Re: [Simple-evcorr-users] Invalid SEC context doesn't raise an error Mills, Rocky
• 2009/08/12 Re: [Simple-evcorr-users] Invalid SEC context doesn't raise an error John P. Rouillard
• 2009/08/12 Re: [Simple-evcorr-users] Invalid SEC context doesn't raise an error Risto Vaarandi
• 2009/08/11 Re: [Simple-evcorr-users] Invalid SEC context doesn't raise an error John P. Rouillard
• 2009/08/11 Re: [Simple-evcorr-users] Invalid SEC context doesn't raise an error Risto Vaarandi
• 2009/08/10 [Simple-evcorr-users] Invalid SEC context doesn't raise an error John P. Rouillard
• 2009/08/10 Re: [Simple-evcorr-users] Correlation of TCP events in virtual interfaces? J Carvalho
• 2009/08/08 Re: [Simple-evcorr-users] Correlation of TCP events in virtual interfaces? John P. Rouillard
• 2009/08/07 [Simple-evcorr-users] Correlation of TCP events in virtual interfaces? J Carvalho
• 2009/08/02 Re: [Simple-evcorr-users] Problem with subpattern variable w/ wierd value John P. Rouillard
• 2009/08/02 Re: [Simple-evcorr-users] Problem with subpattern variable w/ wierd value Risto Vaarandi
• 2009/08/01 [Simple-evcorr-users] Problem with subpattern variable w/ wierd value John P. Rouillard
• 2009/07/29 [Simple-evcorr-users] Count and report suppressed events Thomas Wollner
• 2009/07/27 Re: [Simple-evcorr-users] _INTERNAL_EVENT not being set when processing 'event' action event John P. Rouillard
• 2009/07/27 Re: [Simple-evcorr-users] _INTERNAL_EVENT not being set when processing 'event' action event Risto Vaarandi
• 2009/07/27 Re: [Simple-evcorr-users] _INTERNAL_EVENT not being set when processing 'event' action event Risto Vaarandi
• 2009/07/26 [Simple-evcorr-users] _INTERNAL_EVENT not being set when processing 'event' action event John P. Rouillard
• 2009/07/16 [Simple-evcorr-users] SEC-2.5.2 released Risto Vaarandi
• 2009/07/14 Re: [Simple-evcorr-users] Suppress rule documentation John P. Rouillard
• 2009/07/13 Re: [Simple-evcorr-users] Suppress rule documentation 686f6c6d
• 2009/07/13 Re: [Simple-evcorr-users] Suppress rule documentation 686f6c6d
• 2009/07/12 [Simple-evcorr-users] How to stop sec from syslog-ng Clayton Dukes
• 2009/07/07 Re: [Simple-evcorr-users] Suppress rule documentation Patrick Morris
• 2009/07/07 Re: [Simple-evcorr-users] Suppress rule documentation John P. Rouillard
• 2009/07/07 Re: [Simple-evcorr-users] Suppress rule documentation Risto Vaarandi
• 2009/07/07 Re: [Simple-evcorr-users] Suppress rule documentation 686f6c6d
• 2009/07/07 [Simple-evcorr-users] Suppress rule documentation 686f6c6d
• 2009/06/26 Re: [Simple-evcorr-users] Multiple processes Clayton Dukes
• 2009/06/26 Re: [Simple-evcorr-users] Multiple processes John P. Rouillard
• 2009/06/26 Re: [Simple-evcorr-users] Multiple processes Risto Vaarandi
• 2009/06/26 Re: [Simple-evcorr-users] Multiple processes John P. Rouillard
• 2009/06/26 Re: [Simple-evcorr-users] Multiple processes Clayton Dukes
• 2009/06/26 Re: [Simple-evcorr-users] Multiple processes John P. Rouillard
• 2009/06/26 Re: [Simple-evcorr-users] Multiple processes Risto Vaarandi
• 2009/06/26 [Simple-evcorr-users] Multiple processes Clayton Dukes
• 2009/06/11 Re: [Simple-evcorr-users] email messages as an input? John P. Rouillard
• 2009/06/11 Re: [Simple-evcorr-users] email messages as an input? Don Faulkner
• 2009/06/11 [Simple-evcorr-users] email messages as an input? Don Faulkner
• 2009/06/09 Re: [Simple-evcorr-users] SEC for use with monitoring Risto Vaarandi
• 2009/06/08 Re: [Simple-evcorr-users] Trigger on log file time stamp Risto Vaarandi
• 2009/06/08 Re: [Simple-evcorr-users] Trigger on log file time stamp Hayward, Ben
• 2009/06/07 Re: [Simple-evcorr-users] Trigger on log file time stamp John P. Rouillard
• 2009/06/05 [Simple-evcorr-users] Trigger on log file time stamp Hayward, Ben

• Earlier messages
• Later messages