[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [ISSForum] User Defined Event



As I'd understood you ask about server sensor.
You should build a special segular expression, info about them is available
in sensor's docs (somewhere in apendixes, as I remmember).
All information that you want to be seen in event, can be returned only as
event parameters, so you can see it in details of event from SP Console.
For example, if you want to trigger events when line matches "TEMPLATE" and
to return entire string in details of event (in ':String' param, for
example), perss [Info...] button and in  Name: field type ':String'
(without quotes), in Value: - type '{!}' without quotes too).
You can use regexp in Value: as well: if you need to return everything that
between words 'the' and 'pie' in ':adj' param, you have to assign:
Name: :adj
Value: the {!} pie

in case of 'the flaming pie' you'll get :adj == flaming

Hope this'll help
Good luck.
---
Best regards, Sergey V. Soldatov.
Information security department.


                                                                                                                      
              "Baxter, Kevin"                                                                                         
              <Kevin.Baxter@xxxxxxxxxxxxx        To:       <issforum@xxxxxxx>                                         
              om>                                cc:                                                                  
              Sent by:                           Subject:  [ISSForum] User Defined Event                              
              issforum-bounces@xxxxxxx                                                                                
                                                                                                                      
                                                                                                                      
              13.01.2005 22:02                                                                                        
                                                                                                                      
                                                                                                                      




I have setup a User Defined Event to monitor a .CSV file specific entry
and send an email. The problem I'm having is that I'm trying to return
the line that generated the event. I would appreciate any help.



Thanks

Kpb











_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security
Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.





_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.