No, he did not send any scripts to me. I have written TCL scripts before (I think I helped him get his working) and I will test your question in our environment to see what happens. I'll get back to you Wed or Thurs.
Thanks. David -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ndungu, John Sent: Tuesday, December 20, 2005 8:20 AM To: '[email protected]' Subject: [ISSForum] TCL scripts for fusion module David, Did Michael email you the scripts? Can I see them? I am trying to do the function below Negate Regex: I am trying to create a server sensor policy which would notify me when a particular user logs into a Windows 2000 OS environent and triggers defined event log rule. Suppose there are 3 users (john, tall and Mary) where John and Mary are admistrators of the system (tall is not), what would be the syntax of creating a policy that would negate logins for both John and Mary, but Trigger alerts for Tall? The eventual goal is to be able to track all non-admin login attempts I have tried to use the reular expression [~John|Mary] which negates any entries with John and Marys login credentials, but notify me of all others. Kindly help John ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. ********************************************************************** _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328. _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
