[Bro] any ArcSight users?

[Seth Hall]

On May 15, 2013, at 2:50 PM, Brad Doctor <brad.doctor at gmail.com> wrote:

> we did, but as we customize our format, it didn't work. and we have a lot of sensors reporting in via syslog forwarding, so the flexconnector was the most reliable way to do this. syslog subagent, basically.

What do you mean you customize your format?

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/