Re: [ISSForum] pam.http.post.content

One major item to be aware of is that if you've upgraded to the new
Proventia 1.2 OS then you will loose some functionality in writing custom
regex user events.

We had a dozen user defined events using regex that looked for strings much
like yours. They worked perfectly until we did the 1.2 upgrade. After the
upgrade, what we saw in the Sp event Analysis window when one of these
events was triggerd was our own regex statement NOT the data that was
matched. It's pretty useless to have a screen of events all showing the
same thing instead of the actual http post.

Now the only thing we can do is to log our custom events to an evidence
file, pull it over manually, and look at it with something like Ethereal. I
used to be have some of these user defined events setup to email and it was
great becuase the data would be right there in the email. Now all I get is
my own regex back so we've turned that off.

Hope you don't run into the same issue.

Regards,
Chris Norris CISSP
IS Risk and Security Management Team
American Modern Insurance Companies

_______________________________________________
ISSForum mailing list
ISSForum@iss.net

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to 
https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@iss.net

The ISSForum mailing list is hosted and managed by Internet Security Systems, 
6303 Barfield Road, Atlanta, Georgia, USA 30328.