[ISSForum] TCL scripts for fusion module

David,

Did Michael email you the scripts? Can I see them? I am trying to do the
function below

Negate Regex:


I am trying to create a server sensor policy which would notify me when a
particular user logs into a Windows 2000 OS environent and triggers defined
event log rule.

Suppose there are 3 users (john, tall and Mary) where John and Mary are
admistrators of the system (tall is not), what would be the syntax of
creating a policy that would negate logins for both John and Mary, but
Trigger alerts for Tall? The eventual goal is to be able to track all
non-admin login attempts

I have tried to use the reular expression [~John|Mary] which negates any
entries with John and Marys login credentials, but notify me of all others.

Kindly help
John
 



**********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.
**********************************************************************

_______________________________________________
ISSForum mailing list
ISSForum@iss.net

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to 
https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@iss.net

The ISSForum mailing list is hosted and managed by Internet Security Systems, 
6303 Barfield Road, Atlanta, Georgia, USA 30328.