One major item to be aware of is that if you've upgraded to the new Proventia 1.2 OS then you will loose some functionality in writing custom regex user events.
We had a dozen user defined events using regex that looked for strings much like yours. They worked perfectly until we did the 1.2 upgrade. After the upgrade, what we saw in the Sp event Analysis window when one of these events was triggerd was our own regex statement NOT the data that was matched. It's pretty useless to have a screen of events all showing the same thing instead of the actual http post. Now the only thing we can do is to log our custom events to an evidence file, pull it over manually, and look at it with something like Ethereal. I used to be have some of these user defined events setup to email and it was great becuase the data would be right there in the email. Now all I get is my own regex back so we've turned that off. Hope you don't run into the same issue. Regards, Chris Norris CISSP IS Risk and Security Management Team American Modern Insurance Companies _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
