[Bro] any ArcSight users?

Seth Hall seth at icir.org
Wed May 15 12:02:08 PDT 2013

On May 15, 2013, at 2:50 PM, Brad Doctor <brad.doctor at gmail.com> wrote:

> we did, but as we customize our format, it didn't work. and we have a lot of sensors reporting in via syslog forwarding, so the flexconnector was the most reliable way to do this. syslog subagent, basically.

What do you mean you customize your format?


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the Bro mailing list