Re: Unified2 Missing event record
"Al Lewis \(allewi\) via Snort-devel" <[email protected]> Tue, 16 Jul 2019 16:48:24 +0000
| Newsgroups | gmane.comp.security.ids.snort.devel |
|---|---|
| Message-ID | <[email protected]> |
--===============5214264028343079972== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_70B13184FB6A48F69FA7B6951BF90D4Cciscocom_" --_000_70B13184FB6A48F69FA7B6951BF90D4Cciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGVsbG8sDQoNCllvdSBwcm9iYWJseSB3aWxsIG5lZWQgdG8gc2hvdyBob3cgeW91IGFyZSBydW5u aW5nL3N0YXJ0aW5nIHNub3J0IGFuZCBsb2dnaW5nLg0KDQpJcyB0aGUgaXNzdWUgaGFwcGVuaW5n IG9uIHRoZSBtb3N0IHJlY2VudCB2ZXJzaW9uIG9mIHNub3J0Pw0KDQpBbGJlcnQgTGV3aXMNCkVO R0lORUVSLlNPRlRXQVJFIEVOR0lORUVSSU5HDQpDaXNjbyBTeXN0ZW1zIEluYy4NCkVtYWlsOiBh bGxld2lAY2lzY28uY29tPG1haWx0bzphbGxld2lAY2lzY28uY29tPg0KDQoNCg0KRnJvbTogU25v cnQtZGV2ZWwgPHNub3J0LWRldmVsLWJvdW5jZXNAbGlzdHMuc25vcnQub3JnPiBvbiBiZWhhbGYg b2YgUm9uIEggdmlhIFNub3J0LWRldmVsIDxzbm9ydC1kZXZlbEBsaXN0cy5zbm9ydC5vcmc+DQpS ZXBseS1UbzogUm9uIEggPHJvbmgud29ya0BnbWFpbC5jb20+DQpEYXRlOiBUdWVzZGF5LCBKdWx5 IDE2LCAyMDE5IGF0IDEyOjQ0IFBNDQpUbzogInNub3J0LWRldmVsQGxpc3RzLnNub3J0Lm9yZyIg PHNub3J0LWRldmVsQGxpc3RzLnNub3J0Lm9yZz4NClN1YmplY3Q6IFJlOiBbU25vcnQtZGV2ZWxd IFVuaWZpZWQyIE1pc3NpbmcgZXZlbnQgcmVjb3JkDQoNClVQISA6KQ0KRG9lcyBzb21lb25lIGtu b3cgdGhpcyBpc3N1ZT8NCg0KT24gTW9uLCBKdWwgOCwgMjAxOSBhdCA3OjMxIFBNIFJvbiBIIDxy b25oLndvcmtAZ21haWwuY29tPG1haWx0bzpyb25oLndvcmtAZ21haWwuY29tPj4gd3JvdGU6DQpI ZXkgU25vcnQgZGV2ZWwsDQoNCldlIGhhdmUgYW4gaXNzdWUgd2l0aCBTbm9ydCBVbmlmaWVkMiBv dXRwdXQuDQpTbm9ydCB3cml0ZSBwYWNrZXQgcmVjb3JkIHdpdGhvdXQgd3JpdGUgZXZlbnQgcmVj b3JkLg0KVGhpcyBpc3N1ZSBoYXBwZW5zIGZyZXF1ZW50bHkuDQoNCm91dCBzbm9ydCB2ZXJzaW9u IGlzIDIuOS4xMS4xDQpTbm9ydCBydW4gb24gVWJ1bnR1IDE2LjA0IERvY2tlciBjb250YWluZXIN Cg0KDQpXZSBhcmUgd291bGQgYmUgZ3JhdGVmdWwgdG8gYW55IGFzc2lzdGFuY2UuDQpUaGFua3Mh DQoNCg0KDQoNCg0KDQo= --_000_70B13184FB6A48F69FA7B6951BF90D4Cciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: <[email protected]> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpDb3VyaWVyOw0KCXBhbm9zZS0xOjAgMCAwIDAgMCAwIDAgMCAwIDA7 fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToy IDQgNSAzIDUgNCA2IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsN CglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFt aWx5OiJTZWdvZSBVSSI7DQoJcGFub3NlLTE6MiAxMSA2IDQgMiAyIDIgMiAyIDQ7fQ0KLyogU3R5 bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3Jt YWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEx LjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQphOmxpbmssIHNwYW4u TXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRl eHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0Zv bGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1k ZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5t c29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv Ow0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJD YWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE5DQoJe21zby1zdHlsZS10eXBl OnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNv bG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0 LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4 LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3Jk U2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT4NCjwvaGVhZD4NCjxi b2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9 IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5IZWxsbyw8bzpwPjwvbzpwPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+WW91IHByb2JhYmx5IHdpbGwgbmVlZCB0byBzaG93IGhvdyB5b3UgYXJlIHJ1 bm5pbmcvc3RhcnRpbmcgc25vcnQgYW5kIGxvZ2dpbmcuPG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PklzIHRoZSBpc3N1ZSBoYXBwZW5pbmcgb24gdGhlIG1vc3QgcmVjZW50IHZlcnNpb24gb2Ygc25v cnQ/PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjEzLjBwdDtmb250LWZhbWlseTpDb3VyaWVyO2NvbG9yOiMxRjQ5N0QiPkFsYmVydCBMZXdp czwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtm b250LWZhbWlseTpDb3VyaWVyO2NvbG9yOiM3RjdGN0YiPkVOR0lORUVSLlNPRlRXQVJFIEVOR0lO RUVSSU5HPC9zcGFuPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PG86cD48L286cD48L3NwYW4+ PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7 Zm9udC1mYW1pbHk6Q291cmllcjtjb2xvcjojOTk5OTk5Ij5DaXNjbyBTeXN0ZW1zIEluYy48L3Nw YW4+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q291cmllcjtjb2xvcjoj OTk5OTk5Ij5FbWFpbDombmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkNvdXJp ZXI7Y29sb3I6YmxhY2siPjxhIGhyZWY9Im1haWx0bzphbGxld2lAY2lzY28uY29tIj48c3BhbiBz dHlsZT0iY29sb3I6cHVycGxlIj5hbGxld2lAY2lzY28uY29tPC9zcGFuPjwvYT48L3NwYW4+PHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5OkNvdXJpZXI7Y29sb3I6IzRGODFCRCI+PG86cD48L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNr Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNC NUM0REYgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+RnJvbTog PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+U25v cnQtZGV2ZWwgJmx0O3Nub3J0LWRldmVsLWJvdW5jZXNAbGlzdHMuc25vcnQub3JnJmd0OyBvbiBi ZWhhbGYgb2YgUm9uIEggdmlhIFNub3J0LWRldmVsICZsdDtzbm9ydC1kZXZlbEBsaXN0cy5zbm9y dC5vcmcmZ3Q7PGJyPg0KPGI+UmVwbHktVG86IDwvYj5Sb24gSCAmbHQ7cm9uaC53b3JrQGdtYWls LmNvbSZndDs8YnI+DQo8Yj5EYXRlOiA8L2I+VHVlc2RheSwgSnVseSAxNiwgMjAxOSBhdCAxMjo0 NCBQTTxicj4NCjxiPlRvOiA8L2I+JnF1b3Q7c25vcnQtZGV2ZWxAbGlzdHMuc25vcnQub3JnJnF1 b3Q7ICZsdDtzbm9ydC1kZXZlbEBsaXN0cy5zbm9ydC5vcmcmZ3Q7PGJyPg0KPGI+U3ViamVjdDog PC9iPlJlOiBbU25vcnQtZGV2ZWxdIFVuaWZpZWQyIE1pc3NpbmcgZXZlbnQgcmVjb3JkPG86cD48 L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5V UCEgOikmbmJzcDsgPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ RG9lcyBzb21lb25lIGtub3cgdGhpcyBpc3N1ZT8mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxk aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gTW9uLCBKdWwgOCwgMjAxOSBhdCA3 OjMxIFBNIFJvbiBIICZsdDs8YSBocmVmPSJtYWlsdG86cm9uaC53b3JrQGdtYWlsLmNvbSI+cm9u aC53b3JrQGdtYWlsLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAx LjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1y aWdodDowaW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhleSBTbm9ydCBkZXZlbCwm bmJzcDsgPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5XZSBo YXZlIGFuIGlzc3VlIHdpdGggU25vcnQgVW5pZmllZDIgb3V0cHV0LjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U25vcnQgd3JpdGUgcGFja2V0IHJl Y29yZCB3aXRob3V0IHdyaXRlIGV2ZW50IHJlY29yZC4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoaXMgaXNzdWUgaGFwcGVucyZuYnNw O2ZyZXF1ZW50bHkuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPm91dCBzbm9ydCB2ZXJzaW9uIGlzIDxiPjIuOS4xMS4xPC9iPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U25vcnQgcnVu IG9uIFVidW50dSAxNi4wNCBEb2NrZXIgY29udGFpbmVyPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPHAgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowaW47bWFyZ2luLXJpZ2h0OjBpbjttYXJn aW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDowaW47Ym94LXNpemluZzpib3JkZXItYm94Ij4N CjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O1NlZ29lIFVJ JnF1b3Q7O2NvbG9yOiMyNDI5MkUiPldlIGFyZSB3b3VsZCBiZSBncmF0ZWZ1bCB0byBhbnkgYXNz aXN0YW5jZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7U2Vnb2Ug VUkmcXVvdDs7Y29sb3I6IzI0MjkyRSI+VGhhbmtzITwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8 L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_70B13184FB6A48F69FA7B6951BF90D4Cciscocom_-- --===============5214264028343079972== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Snort-devel mailing list [email protected] https://lists.snort.org/mailman/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort! --===============5214264028343079972==--