[Bro] any ArcSight users?
seth at icir.org
Wed May 15 12:02:08 PDT 2013
On May 15, 2013, at 2:50 PM, Brad Doctor <brad.doctor at gmail.com> wrote:
> we did, but as we customize our format, it didn't work. and we have a lot of sensors reporting in via syslog forwarding, so the flexconnector was the most reliable way to do this. syslog subagent, basically.
What do you mean you customize your format?
International Computer Science Institute
(Bro) because everyone has a network
More information about the Bro