ArcSight Product Documentation

Home

SmartConnector for Bro IDS NG File

sadingrid

2 Likes

over 9 years ago

BroIDSNGFileConfig.pdf

BroIDSNGFileConfig.pdf

BroIDSNGFileConfig.pdf

BroIDSNGFileConfig.pdf

BroIDSNGFileConfig.pdf

BroIDSNGFileConfig.pdf

Tags:

smartconnectors

Labels:

SmartConnectors

SmartConnector

Comment List

Parents

wsladek1 over 8 years ago

While I see the request fields are now populating with data, the Request URL field does not appear to be parsing correctly. It is duplicating some of the URL and in some cases, it leaves the "-" (found in bro's logs for blank fields). Examples:
"http://isc.sans.edu:80/reports.html?isc.sans.edu:80/reports.html"
"http://noscript.net:80/-?noscript.net:80/-"
"http://rules.emergingthreats.net:80/blockrules/compromised-ips.txt?rules.emergingthreats.net:80/blockrules/compromised-ips.txt"
Larry, are you seeing this as well?
- Cancel
- Up 0 Down
- Reply
- More
- Cancel

Comment

wsladek1 over 8 years ago

While I see the request fields are now populating with data, the Request URL field does not appear to be parsing correctly. It is duplicating some of the URL and in some cases, it leaves the "-" (found in bro's logs for blank fields). Examples:
"http://isc.sans.edu:80/reports.html?isc.sans.edu:80/reports.html"
"http://noscript.net:80/-?noscript.net:80/-"
"http://rules.emergingthreats.net:80/blockrules/compromised-ips.txt?rules.emergingthreats.net:80/blockrules/compromised-ips.txt"
Larry, are you seeing this as well?
- Cancel
- Up 0 Down
- Reply
- More
- Cancel

Children

No Data

Related Discussions

Recommended

Resources

CyberRes Academy

Help

Company

Privacy Policy
Terms of Use

Accessibility
Anti-Slavery Statement

Support
How To Buy

Careers
Investor Relations

The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.