In message <1480081672-1374847479-cardhu_decombobulator_blackberry.rim.net-3190 [email protected]>, [email protected] writes:
>I'm currently working with SEC, and first of all I have to say that it is a >powerful and very understandable correlation engine, and we are lucky Risto >built it. > >Nevertheless, i'm facing a problem: if I create a context, will it be shared >between all the configuration files loaded by SEC ? Contexts should be visible to all rules in all config files in a single SEC process. Section 4.1.1. on Rule Segmentation and the use of Guard rules discussed in: http://www.cs.umb.edu/~rouilj/sec/sec_paper_full.pdf wouldn't work if contexts (handled in the example case) weren't visible to all rules. As far as I know this hasn't changed. >I'd like to know that because I'm building many rule files, and I would like >an event that does not match any of them to be processed only by the last >one, which is a forward all rule file. But I don't want the events that match >one previous rule to be written by the last, otherwise all the rule files >are useless. That's what the example does it sets the hndled context only if a ruleset handled the event. The example rulsets at http://www.cs.umb.edu/~rouilj/sec/rulesets/ use this mechanism and the 99rules_reset.sr example reports on any event that wasn't processed using the final: type=single desc=Catch all other lines continue=dontcont ptype=regexp pattern=.? action= write - "UNHANDLED EVENT: $0" rule. -- -- rouilj John Rouillard =========================================================================== My employers don't acknowledge my existence much less my opinions. ------------------------------------------------------------------------------ See everything from the browser to the database with AppDynamics Get end-to-end visibility with application monitoring from AppDynamics Isolate bottlenecks and diagnose root cause in seconds. Start your free trial of AppDynamics Pro today! http://pubads.g.doubleclick.net/gampad/clk?id=48808831&iu=/4140/ostg.clktrk _______________________________________________ Simple-evcorr-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/simple-evcorr-users
