[Bro] any ArcSight users?

Michael Cox mscox42 at gmail.com
Wed May 15 11:47:15 PDT 2013


Did you try their canned "Bro IDS NG" connector? "NG" is their way of
saying v2.1.

It parses OK, but I'm having issues with log rotation. Could you share your
agent.properties file for the rotation options?

Thanks again,
Michael


On Wed, May 15, 2013 at 1:28 PM, Brad Doctor <brad.doctor at gmail.com> wrote:

> yup - a flex connector is your answer.
> -brad
>
>
> On Wed, May 15, 2013 at 11:36 AM, Seth Hall <seth at icir.org> wrote:
>
>>
>> On May 15, 2013, at 1:22 PM, Michael Cox <mscox42 at gmail.com> wrote:
>>
>> > Anyone feeding Bro logs to ArcSight? If so, could you ping me back,
>> please? We can take it off-list.
>>
>> Sounds worthwhile, please keep it on list!
>>
>>   .Seth
>>
>> --
>> Seth Hall
>> International Computer Science Institute
>> (Bro) because everyone has a network
>> http://www.bro.org/
>>
>>
>> _______________________________________________
>> Bro mailing list
>> bro at bro-ids.org
>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20130515/25603c48/attachment.html 


More information about the Bro mailing list