[Bro] any ArcSight users?
mscox42 at gmail.com
Wed May 15 11:47:15 PDT 2013
Did you try their canned "Bro IDS NG" connector? "NG" is their way of
It parses OK, but I'm having issues with log rotation. Could you share your
agent.properties file for the rotation options?
On Wed, May 15, 2013 at 1:28 PM, Brad Doctor <brad.doctor at gmail.com> wrote:
> yup - a flex connector is your answer.
> On Wed, May 15, 2013 at 11:36 AM, Seth Hall <seth at icir.org> wrote:
>> On May 15, 2013, at 1:22 PM, Michael Cox <mscox42 at gmail.com> wrote:
>> > Anyone feeding Bro logs to ArcSight? If so, could you ping me back,
>> please? We can take it off-list.
>> Sounds worthwhile, please keep it on list!
>> Seth Hall
>> International Computer Science Institute
>> (Bro) because everyone has a network
>> Bro mailing list
>> bro at bro-ids.org
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Bro