Proventia ISS IDS rule set
Anuar Sharip <[email protected]> Mon, 28 Feb 2011 21:00:14 +0800
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
--20cf303f6d66bb1739049d5742ef
Content-Type: text/plain; charset=ISO-8859-1
*Hi,
Good Day,
*
*The following rule is not recognized:*
*The log is the following:*
Feb 1 19:02:38 10.19.136.248 Kiwi_Syslog_Server Original
Address=10.19.136.248 community=NRE, agent_ip=10.19.136.248,
eventEntryName25.0=Trace_Route, eventEntryTime25.0="2010-02-01 11:01:53",
eventEntryProtocol25.0="ICMP (1)",
eventEntrySourceIpAddress25.0=10.19.137.10,
eventEntryDestinationIpAddress25.0=207.200.29.90, eventEntryIcmpType25.0=8,
eventEntryIcmpCode25.0=0, eventEntrySourcePort25.0=0,
eventEntryDestinationPort25.0=0,
eventEntryUserActionList25.0="DISPLAY=WithoutRaw:0,SNMP=Security Admin:0",
eventEntryEventSpecificInfo25.0=" :Protocol Name:ICMP;
:target-ip-addr-start:207.200.29.90; :target-ip-addr-end:207.200.29.90;
:event-type:Attack; :repeat-count:1; :count:2; :adapter:A; "
Feb 1 19:05:34 10.19.136.248 Kiwi_Syslog_Server Original
Address=10.19.136.248 community=NRE, agent_ip=10.19.136.248,
eventEntryName25.0=Ping_Sweep, eventEntryTime25.0="2010-02-01 11:04:49",
eventEntryProtocol25.0="ICMP (1)",
eventEntrySourceIpAddress25.0=10.19.140.18,
eventEntryDestinationIpAddress25.0=202.188.0.0, eventEntryIcmpType25.0=8,
eventEntryIcmpCode25.0=0, eventEntrySourcePort25.0=0,
eventEntryDestinationPort25.0=0,
eventEntryUserActionList25.0="DISPLAY=WithoutRaw:0,SNMP=Security Admin:0",
eventEntryEventSpecificInfo25.0=" :Protocol Name:ICMP;
:target-ip-addr-start:202.188.0.0; :target-ip-addr-end:202.188.0.0;
:event-type:Attack; :repeat-count:1;
:victimip:202.188.29.84~202.188.29.87|202.188.63.144-202.188.63.145|202.188.126.19|202.188.163.182|202.188.226.92;
"
Feb 1 19:08:30 10.19.136.248 Kiwi_Syslog_Server Original
Address=10.19.136.248 community=NRE, agent_ip=10.19.136.248,
eventEntryName25.0=HTTP_IIS_Double_Eval_Evasion,
eventEntryTime25.0="2010-02-01 11:06:44", eventEntryProtocol25.0="TCP (6)",
eventEntrySourceIpAddress25.0=65.55.207.98,
eventEntryDestinationIpAddress25.0=10.19.140.54,
eventEntryIcmpType25.0=None, eventEntryIcmpCode25.0=None,
eventEntrySourcePort25.0=11290, eventEntryDestinationPort25.0=80,
eventEntryUserActionList25.0="DISPLAY=WithoutRaw:0,SNMP=Security Admin:0",
eventEntryEventSpecificInfo25.0=" :Protocol Name:TCP;
:target-ip-addr-start:10.19.140.54; :target-ip-addr-end:10.19.140.54;
:event-type:Attack; :repeat-count:1;
:URL:/Glossary/_layouts/VersionDiff.aspx;
:arg:List=%7BB46D9A9A%2D72B3%2D48EF%2D800D%2DB8D71F7BE804%7D&ID=6&Source=%2FGlossary%2F%5Flayouts%2FVersionDiff%2Easpx%3FList%3D%257BB46D9A9A%252D72B3%252D48EF%252D800D%252DB8D71F7BE804%257D%26ID%3D6;
:server:symbiosis.nre.gov.my; :accessed:no; :code:500;
:verdict:attack_failed; :coalescer-info:Forwarded due to age; :adapter:B;
"
Feb 1 19:12:14 10.19.136.248 Kiwi_Syslog_Server Original
Address=10.19.136.248 community=NRE, agent_ip=10.19.136.248,
eventEntryName25.0=HTTP_GET_Dotdotdot_Data, eventEntryTime25.0="2010-02-01
11:11:27", eventEntryProtocol25.0="TCP (6)",
eventEntrySourceIpAddress25.0=189.72.222.101,
eventEntryDestinationIpAddress25.0=10.19.140.30,
eventEntryIcmpType25.0=None, eventEntryIcmpCode25.0=None,
eventEntrySourcePort25.0=1140, eventEntryDestinationPort25.0=80,
eventEntryUserActionList25.0="DISPLAY=WithoutRaw:0,SNMP=Security Admin:0",
eventEntryEventSpecificInfo25.0=" :Protocol Name:TCP;
:target-ip-addr-start:10.19.140.30; :target-ip-addr-end:10.19.140.30;
:event-type:Attack; :repeat-count:1; :URL:/index.php;
:arg:...aliasba.../citegl74.125.47.132/cache:ShBtGh22gbYJ:
www.kptg.gov.my/index.php3Foption3Dcom_contact26view3Dcontact26id3D991253Amohdaliasbarashid26catid3D92253Apahang26Itemid3D14326lang3Dms=http://zbajj.gov.cn/autobox.txt?;
:server:www.kptg.gov.my; :httpsvr:Apache/2.2.13 (Win32) mod_ssl/2.2.13
OpenSSL/0.9.8k PHP/5.2.11; :accessed:yes; :code:200; :adapter:B; "
*and the following is proventia-iss rules:-*
regex=Original Address=\S+ community=(.*),.* agent_ip=\S+,
eventEntryName25.0=(.*), eventEntryTime25.0=\"(.*)",
eventEntryProtocol25.0=\"(\S+).*\", eventEntrySourceIpAddress25.0=(\S+),
eventEntryDestinationIpAddress25.0=(\S+),.*eventEntrySourcePort25.0=(\S+),
eventEntryDestinationPort25.0=(\d+), eventEntryUserActionList25.0=\"(.*)\",
eventEntryEventSpecificInfo25.0=\"(.*)\".*; \
classification.text=$2; \
id=20101; \
revision=2; \
analyzer(0).manufacturer=IBM Proventia ISS; \
assessment.impact.completion=failed; \
assessment.impact.severity=medium; \
assessment.impact.description=IBM Proventia ISS alert; \
source(0).node.address(0).address=$5; \
source(0).service.port=$7; \
source(0).service.iana_protocol_name=$4; \
target(0).node.address(0).address=$6; \
target(0).service.port=$8; \
target(0).service.iana_protocol_name=$4; \
additional_data(0).type=string; \
additional_data(0).meaning=Event Entry Time; \
additional_data(0).data=$3; \
additional_data(1).type=string; \
additional_data(1).meaning=User Actions list; \
additional_data(1).data=$9; \
additional_data(2).type=string; \
additional_data(2).meaning=Event specific info; \
additional_data(2).data=$10; \
additional_data(3).meaning=Community; \
additional_data(3).data=$1; \
additional_data(3).type=string; \
last;
*and the following is the prelude-lml.conf:-*
[format=syslog4]
time-format = "%b %d %H:%M:%S"
prefix-regex = "^(?P<timestamp>.{15}) (?P<hostname>\S+)
(?:(?P<process>\S+?)(?:\[(?P<pid>[0-9]+)\])?: )?"
file = /home/devicelogs/10.19.136.248/10.19.136.248.log
idmef-alter = alert.analyzer(-1).node.location = KV-SGR-HQ-IPS
Kindly please advice where to find error log to troubleshoot further as we
not getting any outcome in *PREWIKKA.*
Thanks!
--20cf303f6d66bb1739049d5742ef
Content-Type: application/octet-stream; name="10.19.136.248.log"
Content-Disposition: attachment; filename="10.19.136.248.log"
Content-Transfer-Encoding: base64
X-Attachment-Id: f_gkpe08fq0
RmViICAxIDE5OjAyOjM4IDEwLjE5LjEzNi4yNDggS2l3aV9TeXNsb2dfU2VydmVyIE9yaWdpbmFs
IEFkZHJlc3M9MTAuMTkuMTM2LjI0OCBjb21tdW5pdHk9TlJFLCBhZ2VudF9pcD0xMC4xOS4xMzYu
MjQ4LCBldmVudEVudHJ5TmFtZTI1LjA9VHJhY2VfUm91dGUsIGV2ZW50RW50cnlUaW1lMjUuMD0i
MjAxMC0wMi0wMSAxMTowMTo1MyIsIGV2ZW50RW50cnlQcm90b2NvbDI1LjA9IklDTVAgKDEpIiwg
ZXZlbnRFbnRyeVNvdXJjZUlwQWRkcmVzczI1LjA9MTAuMTkuMTM3LjEwLCBldmVudEVudHJ5RGVz
dGluYXRpb25JcEFkZHJlc3MyNS4wPTIwNy4yMDAuMjkuOTAsIGV2ZW50RW50cnlJY21wVHlwZTI1
LjA9OCwgZXZlbnRFbnRyeUljbXBDb2RlMjUuMD0wLCBldmVudEVudHJ5U291cmNlUG9ydDI1LjA9
MCwgZXZlbnRFbnRyeURlc3RpbmF0aW9uUG9ydDI1LjA9MCwgZXZlbnRFbnRyeVVzZXJBY3Rpb25M
aXN0MjUuMD0iRElTUExBWT1XaXRob3V0UmF3OjAsU05NUD1TZWN1cml0eSBBZG1pbjowIiwgZXZl
bnRFbnRyeUV2ZW50U3BlY2lmaWNJbmZvMjUuMD0iIDpQcm90b2NvbCBOYW1lOklDTVA7ICA6dGFy
Z2V0LWlwLWFkZHItc3RhcnQ6MjA3LjIwMC4yOS45MDsgIDp0YXJnZXQtaXAtYWRkci1lbmQ6MjA3
LjIwMC4yOS45MDsgIDpldmVudC10eXBlOkF0dGFjazsgIDpyZXBlYXQtY291bnQ6MTsgIDpjb3Vu
dDoyOyAgOmFkYXB0ZXI6QTsgIg0KIA0KRmViICAxIDE5OjA1OjM0IDEwLjE5LjEzNi4yNDggS2l3
aV9TeXNsb2dfU2VydmVyIE9yaWdpbmFsIEFkZHJlc3M9MTAuMTkuMTM2LjI0OCBjb21tdW5pdHk9
TlJFLCBhZ2VudF9pcD0xMC4xOS4xMzYuMjQ4LCBldmVudEVudHJ5TmFtZTI1LjA9UGluZ19Td2Vl
cCwgZXZlbnRFbnRyeVRpbWUyNS4wPSIyMDEwLTAyLTAxIDExOjA0OjQ5IiwgZXZlbnRFbnRyeVBy
b3RvY29sMjUuMD0iSUNNUCAoMSkiLCBldmVudEVudHJ5U291cmNlSXBBZGRyZXNzMjUuMD0xMC4x
OS4xNDAuMTgsIGV2ZW50RW50cnlEZXN0aW5hdGlvbklwQWRkcmVzczI1LjA9MjAyLjE4OC4wLjAs
IGV2ZW50RW50cnlJY21wVHlwZTI1LjA9OCwgZXZlbnRFbnRyeUljbXBDb2RlMjUuMD0wLCBldmVu
dEVudHJ5U291cmNlUG9ydDI1LjA9MCwgZXZlbnRFbnRyeURlc3RpbmF0aW9uUG9ydDI1LjA9MCwg
ZXZlbnRFbnRyeVVzZXJBY3Rpb25MaXN0MjUuMD0iRElTUExBWT1XaXRob3V0UmF3OjAsU05NUD1T
ZWN1cml0eSBBZG1pbjowIiwgZXZlbnRFbnRyeUV2ZW50U3BlY2lmaWNJbmZvMjUuMD0iIDpQcm90
b2NvbCBOYW1lOklDTVA7ICA6dGFyZ2V0LWlwLWFkZHItc3RhcnQ6MjAyLjE4OC4wLjA7ICA6dGFy
Z2V0LWlwLWFkZHItZW5kOjIwMi4xODguMC4wOyAgOmV2ZW50LXR5cGU6QXR0YWNrOyAgOnJlcGVh
dC1jb3VudDoxOyAgOnZpY3RpbWlwOjIwMi4xODguMjkuODR+MjAyLjE4OC4yOS44N3wyMDIuMTg4
LjYzLjE0NC0yMDIuMTg4LjYzLjE0NXwyMDIuMTg4LjEyNi4xOXwyMDIuMTg4LjE2My4xODJ8MjAy
LjE4OC4yMjYuOTI7ICINCiANCkZlYiAgMSAxOTowODozMCAxMC4xOS4xMzYuMjQ4IEtpd2lfU3lz
bG9nX1NlcnZlciBPcmlnaW5hbCBBZGRyZXNzPTEwLjE5LjEzNi4yNDggY29tbXVuaXR5PU5SRSwg
YWdlbnRfaXA9MTAuMTkuMTM2LjI0OCwgZXZlbnRFbnRyeU5hbWUyNS4wPUhUVFBfSUlTX0RvdWJs
ZV9FdmFsX0V2YXNpb24sIGV2ZW50RW50cnlUaW1lMjUuMD0iMjAxMC0wMi0wMSAxMTowNjo0NCIs
IGV2ZW50RW50cnlQcm90b2NvbDI1LjA9IlRDUCAoNikiLCBldmVudEVudHJ5U291cmNlSXBBZGRy
ZXNzMjUuMD02NS41NS4yMDcuOTgsIGV2ZW50RW50cnlEZXN0aW5hdGlvbklwQWRkcmVzczI1LjA9
MTAuMTkuMTQwLjU0LCBldmVudEVudHJ5SWNtcFR5cGUyNS4wPU5vbmUsIGV2ZW50RW50cnlJY21w
Q29kZTI1LjA9Tm9uZSwgZXZlbnRFbnRyeVNvdXJjZVBvcnQyNS4wPTExMjkwLCBldmVudEVudHJ5
RGVzdGluYXRpb25Qb3J0MjUuMD04MCwgZXZlbnRFbnRyeVVzZXJBY3Rpb25MaXN0MjUuMD0iRElT
UExBWT1XaXRob3V0UmF3OjAsU05NUD1TZWN1cml0eSBBZG1pbjowIiwgZXZlbnRFbnRyeUV2ZW50
U3BlY2lmaWNJbmZvMjUuMD0iIDpQcm90b2NvbCBOYW1lOlRDUDsgIDp0YXJnZXQtaXAtYWRkci1z
dGFydDoxMC4xOS4xNDAuNTQ7ICA6dGFyZ2V0LWlwLWFkZHItZW5kOjEwLjE5LjE0MC41NDsgIDpl
dmVudC10eXBlOkF0dGFjazsgIDpyZXBlYXQtY291bnQ6MTsgIDpVUkw6L0dsb3NzYXJ5L19sYXlv
dXRzL1ZlcnNpb25EaWZmLmFzcHg7ICA6YXJnOkxpc3Q9JTdCQjQ2RDlBOUElMkQ3MkIzJTJENDhF
RiUyRDgwMEQlMkRCOEQ3MUY3QkU4MDQlN0QmSUQ9NiZTb3VyY2U9JTJGR2xvc3NhcnklMkYlNUZs
YXlvdXRzJTJGVmVyc2lvbkRpZmYlMkVhc3B4JTNGTGlzdCUzRCUyNTdCQjQ2RDlBOUElMjUyRDcy
QjMlMjUyRDQ4RUYlMjUyRDgwMEQlMjUyREI4RDcxRjdCRTgwNCUyNTdEJTI2SUQlM0Q2OyAgOnNl
cnZlcjpzeW1iaW9zaXMubnJlLmdvdi5teTsgIDphY2Nlc3NlZDpubzsgIDpjb2RlOjUwMDsgIDp2
ZXJkaWN0OmF0dGFja19mYWlsZWQ7ICA6Y29hbGVzY2VyLWluZm86Rm9yd2FyZGVkIGR1ZSB0byBh
Z2U7ICA6YWRhcHRlcjpCOyAiDQogDQpGZWIgIDEgMTk6MTI6MTQgMTAuMTkuMTM2LjI0OCBLaXdp
X1N5c2xvZ19TZXJ2ZXIgT3JpZ2luYWwgQWRkcmVzcz0xMC4xOS4xMzYuMjQ4IGNvbW11bml0eT1O
UkUsIGFnZW50X2lwPTEwLjE5LjEzNi4yNDgsIGV2ZW50RW50cnlOYW1lMjUuMD1IVFRQX0dFVF9E
b3Rkb3Rkb3RfRGF0YSwgZXZlbnRFbnRyeVRpbWUyNS4wPSIyMDEwLTAyLTAxIDExOjExOjI3Iiwg
ZXZlbnRFbnRyeVByb3RvY29sMjUuMD0iVENQICg2KSIsIGV2ZW50RW50cnlTb3VyY2VJcEFkZHJl
c3MyNS4wPTE4OS43Mi4yMjIuMTAxLCBldmVudEVudHJ5RGVzdGluYXRpb25JcEFkZHJlc3MyNS4w
PTEwLjE5LjE0MC4zMCwgZXZlbnRFbnRyeUljbXBUeXBlMjUuMD1Ob25lLCBldmVudEVudHJ5SWNt
cENvZGUyNS4wPU5vbmUsIGV2ZW50RW50cnlTb3VyY2VQb3J0MjUuMD0xMTQwLCBldmVudEVudHJ5
RGVzdGluYXRpb25Qb3J0MjUuMD04MCwgZXZlbnRFbnRyeVVzZXJBY3Rpb25MaXN0MjUuMD0iRElT
UExBWT1XaXRob3V0UmF3OjAsU05NUD1TZWN1cml0eSBBZG1pbjowIiwgZXZlbnRFbnRyeUV2ZW50
U3BlY2lmaWNJbmZvMjUuMD0iIDpQcm90b2NvbCBOYW1lOlRDUDsgIDp0YXJnZXQtaXAtYWRkci1z
dGFydDoxMC4xOS4xNDAuMzA7ICA6dGFyZ2V0LWlwLWFkZHItZW5kOjEwLjE5LjE0MC4zMDsgIDpl
dmVudC10eXBlOkF0dGFjazsgIDpyZXBlYXQtY291bnQ6MTsgIDpVUkw6L2luZGV4LnBocDsgIDph
cmc6Li4uYWxpYXNiYS4uLi9jaXRlZ2w3NC4xMjUuNDcuMTMyL2NhY2hlOlNoQnRHaDIyZ2JZSjp3
d3cua3B0Zy5nb3YubXkvaW5kZXgucGhwM0ZvcHRpb24zRGNvbV9jb250YWN0MjZ2aWV3M0Rjb250
YWN0MjZpZDNEOTkxMjUzQW1vaGRhbGlhc2JhcmFzaGlkMjZjYXRpZDNEOTIyNTNBcGFoYW5nMjZJ
dGVtaWQzRDE0MzI2bGFuZzNEbXM9aHR0cDovL3piYWpqLmdvdi5jbi9hdXRvYm94LnR4dD87ICA6
c2VydmVyOnd3dy5rcHRnLmdvdi5teTsgIDpodHRwc3ZyOkFwYWNoZS8yLjIuMTMgKFdpbjMyKSBt
b2Rfc3NsLzIuMi4xMyBPcGVuU1NMLzAuOS44ayBQSFAvNS4yLjExOyAgOmFjY2Vzc2VkOnllczsg
IDpjb2RlOjIwMDsgIDphZGFwdGVyOkI7ICI=
--20cf303f6d66bb1739049d5742ef
Content-Type: application/octet-stream; name="proventia-iss.rules"
Content-Disposition: attachment; filename="proventia-iss.rules"
Content-Transfer-Encoding: base64
X-Attachment-Id: f_gkpe9mza1
I0xPRzogRmViICAxIDE5OjExOjEyIDEwLjE5LjEzNi4yNDcgS2l3aV9TeXNsb2dfU2VydmVyIE9y
aWdpbmFsIEFkZHJlc3M9MTAuMTkuMTM2LjI0NyBjb21tdW5pdHk9TlJFLCBhZ2VudF9pcD0xMC4x
OS4xMzYuMjQ3LCBldmVudEVudHJ5TmFtZTI1LjA9UGluZ19Td2VlcCwgZXZlbnRFbnRyeVRpbWUy
NS4wPSIyMDEwLTAyLTAxIDExOjEwOjI3IiwgZXZlbnRFbnRyeVByb3RvY29sMjUuMD0iSUNNUCAo
MSkiLCBldmVudEVudHJ5U291cmNlSXBBZGRyZXNzMjUuMD0xMC4xOS4xNDAuMTgsIGV2ZW50RW50
cnlEZXN0aW5hdGlvbklwQWRkcmVzczI1LjA9MTAuMTkuMC4wLCBldmVudEVudHJ5SWNtcFR5cGUy
NS4wPTgsIGV2ZW50RW50cnlJY21wQ29kZTI1LjA9MCwgZXZlbnRFbnRyeVNvdXJjZVBvcnQyNS4w
PTAsIGV2ZW50RW50cnlEZXN0aW5hdGlvblBvcnQyNS4wPTAsIGV2ZW50RW50cnlVc2VyQWN0aW9u
TGlzdDI1LjA9IkRJU1BMQVk9V2l0aG91dFJhdzowLFNOTVA9U2VjdXJpdHkgQWRtaW46MCIsIGV2
ZW50RW50cnlFdmVudFNwZWNpZmljSW5mbzI1LjA9IiA6UHJvdG9jb2wgTmFtZTpJQ01QOyAgOnRh
cmdldC1pcC1hZGRyLXN0YXJ0OjEwLjE5LjAuMDsgIDp0YXJnZXQtaXAtYWRkci1lbmQ6MTAuMTku
MC4wOyAgOmV2ZW50LXR5cGU6QXR0YWNrOyAgOnJlcGVhdC1jb3VudDoxOyAgOnZpY3RpbWlwOjEw
LjE5LjEzOC40MC0xMC4xOS4xMzguNDN8MTAuMTkuMTM4LjcwfDEwLjE5LjEzOC4xNTV8MTAuMTku
MTM4LjE3NnwxMC4xOS4xMzguMjA1OyAiDQoNCiNldmVudEVudHJ5TmFtZTI1PSJTaXRlUHJvdGVj
dG9yX0NlbnRyYWxfUmVzcG9uc2UgKEF0dGFjayBOb3RpZmljYXRpb24pIiwNCiNldmVudEVudHJ5
VGltZTI1PSIxMjo0MTozMCAyMDEwLTAyLTAzIiwNCiNldmVudEVudHJ5U291cmNlSXBBZGRyZXNz
MjU9MTAuMTkuMTMyLjI1LA0KI2V2ZW50RW50cnlEZXN0aW5hdGlvbklwQWRkcmVzczI1PTY2LjIy
MC4xNDYuMTUsDQojZXZlbnRFbnRyeVNvdXJjZVBvcnQyNT11bmtub3duLA0KI2V2ZW50RW50cnlE
ZXN0aW5hdGlvblBvcnQyNT1odHRwLA0KI2V2ZW50RW50cnlVc2VyQWN0aW9uTGlzdDI1PSJESVNQ
TEFZPVdpdGhvdXRSYXc6MCxCTE9DSz1EZWZhdWx0OjAsDQojIA0KI2V2ZW50RW50cnlFdmVudFNw
ZWNpZmljSW5mbzI1PSIgQWxlcnROYW1lOiBTUUxfSW5qZWN0aW9uIEFsZXJ0RGF0ZVRpbWU6IDEy
OjM5OjExIDIwMTAtMDItMDMgU2Vuc29ySVBBZGRyZXNzOiAxMC4xOS4xMzYuMjQ3IFNlbnNvck5h
bWU6IElQU19JbnRlcm5hbCBWdWxuU3RhdHVzOiBBdHRhY2sgZmFpbHVyZSAoYmxvY2tlZCBieSBQ
cm92ZW50aWEgYXBwbGlhbmNlKSBPYmplY3RUeXBlOiBUYXJnZXQgUG9ydCBPYmplY3ROYW1lOiA4
MCBTb3VyY2VfUG9ydDogMCINCiMNCiMjIHJlZ2V4PU9yaWdpbmFsIEFkZHJlc3M9XFMrIGNvbW11
bml0eT0oJDEpLC4qIGFnZW50X2lwPVxTKywgZXZlbnRFbnRyeU5hbWUyNS4wPSgkMiksIGV2ZW50
RW50cnlUaW1lMjUuMD1cIigkMykiLCBldmVudEVudHJ5UHJvdG9jb2wyNS4wPVwiKCQ0KS4qXCIs
IGV2ZW50RW50cnlTb3VyY2VJcEFkZHJlc3MyNS4wPSgkNSksIGV2ZW50RW50cnlEZXN0aW5hdGlv
bklwQWRkcmVzczI1LjA9KCQ2KSwuKmV2ZW50RW50cnlTb3VyY2VQb3J0MjUuMD0oJDcpLCBldmVu
dEVudHJ5RGVzdGluYXRpb25Qb3J0MjUuMD0oJDgpLCBldmVudEVudHJ5VXNlckFjdGlvbkxpc3Qy
NS4wPVwiKCQ5KVwiLCBldmVudEVudHJ5RXZlbnRTcGVjaWZpY0luZm8yNS4wPVwiKCQxMClcIi4q
OyBcDQoNCnJlZ2V4PU9yaWdpbmFsIEFkZHJlc3M9XFMrIGNvbW11bml0eT0oLiopLC4qIGFnZW50
X2lwPVxTKywgZXZlbnRFbnRyeU5hbWUyNS4wPSguKiksIGV2ZW50RW50cnlUaW1lMjUuMD1cIigu
KikiLCBldmVudEVudHJ5UHJvdG9jb2wyNS4wPVwiKFxTKykuKlwiLCBldmVudEVudHJ5U291cmNl
SXBBZGRyZXNzMjUuMD0oXFMrKSwgZXZlbnRFbnRyeURlc3RpbmF0aW9uSXBBZGRyZXNzMjUuMD0o
XFMrKSwuKmV2ZW50RW50cnlTb3VyY2VQb3J0MjUuMD0oXFMrKSwgZXZlbnRFbnRyeURlc3RpbmF0
aW9uUG9ydDI1LjA9KFxkKyksIGV2ZW50RW50cnlVc2VyQWN0aW9uTGlzdDI1LjA9XCIoLiopXCIs
IGV2ZW50RW50cnlFdmVudFNwZWNpZmljSW5mbzI1LjA9XCIoLiopXCIuKjsgXA0KIGNsYXNzaWZp
Y2F0aW9uLnRleHQ9JDI7IFwNCiBpZD0yMDEwMTsgXA0KIHJldmlzaW9uPTI7IFwNCiBhbmFseXpl
cigwKS5tYW51ZmFjdHVyZXI9SUJNIFByb3ZlbnRpYSBJU1M7IFwNCiBhc3Nlc3NtZW50LmltcGFj
dC5jb21wbGV0aW9uPWZhaWxlZDsgXA0KIGFzc2Vzc21lbnQuaW1wYWN0LnNldmVyaXR5PW1lZGl1
bTsgXA0KIGFzc2Vzc21lbnQuaW1wYWN0LmRlc2NyaXB0aW9uPUlCTSBQcm92ZW50aWEgSVNTIGFs
ZXJ0OyBcDQogc291cmNlKDApLm5vZGUuYWRkcmVzcygwKS5hZGRyZXNzPSQ1OyBcDQogc291cmNl
KDApLnNlcnZpY2UucG9ydD0kNzsgXA0KIHNvdXJjZSgwKS5zZXJ2aWNlLmlhbmFfcHJvdG9jb2xf
bmFtZT0kNDsgXA0KIHRhcmdldCgwKS5ub2RlLmFkZHJlc3MoMCkuYWRkcmVzcz0kNjsgXA0KIHRh
cmdldCgwKS5zZXJ2aWNlLnBvcnQ9JDg7IFwNCiB0YXJnZXQoMCkuc2VydmljZS5pYW5hX3Byb3Rv
Y29sX25hbWU9JDQ7IFwNCiBhZGRpdGlvbmFsX2RhdGEoMCkudHlwZT1zdHJpbmc7IFwNCiBhZGRp
dGlvbmFsX2RhdGEoMCkubWVhbmluZz1FdmVudCBFbnRyeSBUaW1lOyBcDQogYWRkaXRpb25hbF9k
YXRhKDApLmRhdGE9JDM7IFwNCiBhZGRpdGlvbmFsX2RhdGEoMSkudHlwZT1zdHJpbmc7IFwNCiBh
ZGRpdGlvbmFsX2RhdGEoMSkubWVhbmluZz1Vc2VyIEFjdGlvbnMgbGlzdDsgXA0KIGFkZGl0aW9u
YWxfZGF0YSgxKS5kYXRhPSQ5OyBcDQogYWRkaXRpb25hbF9kYXRhKDIpLnR5cGU9c3RyaW5nOyBc
DQogYWRkaXRpb25hbF9kYXRhKDIpLm1lYW5pbmc9RXZlbnQgc3BlY2lmaWMgaW5mbzsgXA0KIGFk
ZGl0aW9uYWxfZGF0YSgyKS5kYXRhPSQxMDsgXA0KIGFkZGl0aW9uYWxfZGF0YSgzKS5tZWFuaW5n
PUNvbW11bml0eTsgXA0KIGFkZGl0aW9uYWxfZGF0YSgzKS5kYXRhPSQxOyBcDQogYWRkaXRpb25h
bF9kYXRhKDMpLnR5cGU9c3RyaW5nOyBcDQogbGFzdDsNCg0K
--20cf303f6d66bb1739049d5742ef
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-user
--20cf303f6d66bb1739049d5742ef--