Re: Unified2 Missing event record

"Al Lewis \(allewi\) via Snort-devel" <[email protected]> Tue, 16 Jul 2019 16:48:24 +0000
Newsgroups gmane.comp.security.ids.snort.devel
Message-ID <[email protected]>
--===============5214264028343079972==
Content-Language: en-US
Content-Type: multipart/alternative;
	boundary="_000_70B13184FB6A48F69FA7B6951BF90D4Cciscocom_"

--_000_70B13184FB6A48F69FA7B6951BF90D4Cciscocom_
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64

SGVsbG8sDQoNCllvdSBwcm9iYWJseSB3aWxsIG5lZWQgdG8gc2hvdyBob3cgeW91IGFyZSBydW5u
aW5nL3N0YXJ0aW5nIHNub3J0IGFuZCBsb2dnaW5nLg0KDQpJcyB0aGUgaXNzdWUgaGFwcGVuaW5n
IG9uIHRoZSBtb3N0IHJlY2VudCB2ZXJzaW9uIG9mIHNub3J0Pw0KDQpBbGJlcnQgTGV3aXMNCkVO
R0lORUVSLlNPRlRXQVJFIEVOR0lORUVSSU5HDQpDaXNjbyBTeXN0ZW1zIEluYy4NCkVtYWlsOiBh
bGxld2lAY2lzY28uY29tPG1haWx0bzphbGxld2lAY2lzY28uY29tPg0KDQoNCg0KRnJvbTogU25v
cnQtZGV2ZWwgPHNub3J0LWRldmVsLWJvdW5jZXNAbGlzdHMuc25vcnQub3JnPiBvbiBiZWhhbGYg
b2YgUm9uIEggdmlhIFNub3J0LWRldmVsIDxzbm9ydC1kZXZlbEBsaXN0cy5zbm9ydC5vcmc+DQpS
ZXBseS1UbzogUm9uIEggPHJvbmgud29ya0BnbWFpbC5jb20+DQpEYXRlOiBUdWVzZGF5LCBKdWx5
IDE2LCAyMDE5IGF0IDEyOjQ0IFBNDQpUbzogInNub3J0LWRldmVsQGxpc3RzLnNub3J0Lm9yZyIg
PHNub3J0LWRldmVsQGxpc3RzLnNub3J0Lm9yZz4NClN1YmplY3Q6IFJlOiBbU25vcnQtZGV2ZWxd
IFVuaWZpZWQyIE1pc3NpbmcgZXZlbnQgcmVjb3JkDQoNClVQISA6KQ0KRG9lcyBzb21lb25lIGtu
b3cgdGhpcyBpc3N1ZT8NCg0KT24gTW9uLCBKdWwgOCwgMjAxOSBhdCA3OjMxIFBNIFJvbiBIIDxy
b25oLndvcmtAZ21haWwuY29tPG1haWx0bzpyb25oLndvcmtAZ21haWwuY29tPj4gd3JvdGU6DQpI
ZXkgU25vcnQgZGV2ZWwsDQoNCldlIGhhdmUgYW4gaXNzdWUgd2l0aCBTbm9ydCBVbmlmaWVkMiBv
dXRwdXQuDQpTbm9ydCB3cml0ZSBwYWNrZXQgcmVjb3JkIHdpdGhvdXQgd3JpdGUgZXZlbnQgcmVj
b3JkLg0KVGhpcyBpc3N1ZSBoYXBwZW5zIGZyZXF1ZW50bHkuDQoNCm91dCBzbm9ydCB2ZXJzaW9u
IGlzIDIuOS4xMS4xDQpTbm9ydCBydW4gb24gVWJ1bnR1IDE2LjA0IERvY2tlciBjb250YWluZXIN
Cg0KDQpXZSBhcmUgd291bGQgYmUgZ3JhdGVmdWwgdG8gYW55IGFzc2lzdGFuY2UuDQpUaGFua3Mh
DQoNCg0KDQoNCg0KDQo=

--_000_70B13184FB6A48F69FA7B6951BF90D4Cciscocom_
Content-Type: text/html; charset="utf-8"
Content-ID: <[email protected]>
Content-Transfer-Encoding: base64

PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4
bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo
dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo
dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp
dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l
dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg
bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj
ZQ0KCXtmb250LWZhbWlseTpDb3VyaWVyOw0KCXBhbm9zZS0xOjAgMCAwIDAgMCAwIDAgMCAwIDA7
fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToy
IDQgNSAzIDUgNCA2IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsN
CglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFt
aWx5OiJTZWdvZSBVSSI7DQoJcGFub3NlLTE6MiAxMSA2IDQgMiAyIDIgMiAyIDQ7fQ0KLyogU3R5
bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3Jt
YWwNCgl7bWFyZ2luOjBpbjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjEx
LjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQphOmxpbmssIHNwYW4u
TXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRl
eHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0Zv
bGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1k
ZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5t
c29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1h
bHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv
Ow0KCW1hcmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJD
YWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE5DQoJe21zby1zdHlsZS10eXBl
OnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNv
bG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0
LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4
LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3Jk
U2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT4NCjwvaGVhZD4NCjxi
b2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYgY2xhc3M9
IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5IZWxsbyw8bzpwPjwvbzpwPjwv
cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9
Ik1zb05vcm1hbCI+WW91IHByb2JhYmx5IHdpbGwgbmVlZCB0byBzaG93IGhvdyB5b3UgYXJlIHJ1
bm5pbmcvc3RhcnRpbmcgc25vcnQgYW5kIGxvZ2dpbmcuPG86cD48L286cD48L3A+DQo8cCBjbGFz
cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi
PklzIHRoZSBpc3N1ZSBoYXBwZW5pbmcgb24gdGhlIG1vc3QgcmVjZW50IHZlcnNpb24gb2Ygc25v
cnQ/PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw
PjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1z
aXplOjEzLjBwdDtmb250LWZhbWlseTpDb3VyaWVyO2NvbG9yOiMxRjQ5N0QiPkFsYmVydCBMZXdp
czwvc3Bhbj48L2I+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48
L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtm
b250LWZhbWlseTpDb3VyaWVyO2NvbG9yOiM3RjdGN0YiPkVOR0lORUVSLlNPRlRXQVJFIEVOR0lO
RUVSSU5HPC9zcGFuPjxzcGFuIHN0eWxlPSJjb2xvcjpibGFjayI+PG86cD48L286cD48L3NwYW4+
PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7
Zm9udC1mYW1pbHk6Q291cmllcjtjb2xvcjojOTk5OTk5Ij5DaXNjbyBTeXN0ZW1zIEluYy48L3Nw
YW4+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj
bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6Q291cmllcjtjb2xvcjoj
OTk5OTk5Ij5FbWFpbDombmJzcDs8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OkNvdXJp
ZXI7Y29sb3I6YmxhY2siPjxhIGhyZWY9Im1haWx0bzphbGxld2lAY2lzY28uY29tIj48c3BhbiBz
dHlsZT0iY29sb3I6cHVycGxlIj5hbGxld2lAY2lzY28uY29tPC9zcGFuPjwvYT48L3NwYW4+PHNw
YW4gc3R5bGU9ImZvbnQtZmFtaWx5OkNvdXJpZXI7Y29sb3I6IzRGODFCRCI+PG86cD48L286cD48
L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNr
Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt
YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz
cDs8L286cD48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNC
NUM0REYgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9y
bWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+RnJvbTog
PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+U25v
cnQtZGV2ZWwgJmx0O3Nub3J0LWRldmVsLWJvdW5jZXNAbGlzdHMuc25vcnQub3JnJmd0OyBvbiBi
ZWhhbGYgb2YgUm9uIEggdmlhIFNub3J0LWRldmVsICZsdDtzbm9ydC1kZXZlbEBsaXN0cy5zbm9y
dC5vcmcmZ3Q7PGJyPg0KPGI+UmVwbHktVG86IDwvYj5Sb24gSCAmbHQ7cm9uaC53b3JrQGdtYWls
LmNvbSZndDs8YnI+DQo8Yj5EYXRlOiA8L2I+VHVlc2RheSwgSnVseSAxNiwgMjAxOSBhdCAxMjo0
NCBQTTxicj4NCjxiPlRvOiA8L2I+JnF1b3Q7c25vcnQtZGV2ZWxAbGlzdHMuc25vcnQub3JnJnF1
b3Q7ICZsdDtzbm9ydC1kZXZlbEBsaXN0cy5zbm9ydC5vcmcmZ3Q7PGJyPg0KPGI+U3ViamVjdDog
PC9iPlJlOiBbU25vcnQtZGV2ZWxdIFVuaWZpZWQyIE1pc3NpbmcgZXZlbnQgcmVjb3JkPG86cD48
L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86
cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5V
UCEgOikmbmJzcDsgPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+
RG9lcyBzb21lb25lIGtub3cgdGhpcyBpc3N1ZT8mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2
Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxk
aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gTW9uLCBKdWwgOCwgMjAxOSBhdCA3
OjMxIFBNIFJvbiBIICZsdDs8YSBocmVmPSJtYWlsdG86cm9uaC53b3JrQGdtYWlsLmNvbSI+cm9u
aC53b3JrQGdtYWlsLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8
YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAx
LjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1y
aWdodDowaW4iPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhleSBTbm9ydCBkZXZlbCwm
bmJzcDsgPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m
bmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5XZSBo
YXZlIGFuIGlzc3VlIHdpdGggU25vcnQgVW5pZmllZDIgb3V0cHV0LjxvOnA+PC9vOnA+PC9wPg0K
PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U25vcnQgd3JpdGUgcGFja2V0IHJl
Y29yZCB3aXRob3V0IHdyaXRlIGV2ZW50IHJlY29yZC4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv
ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoaXMgaXNzdWUgaGFwcGVucyZuYnNw
O2ZyZXF1ZW50bHkuJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz
cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs
YXNzPSJNc29Ob3JtYWwiPm91dCBzbm9ydCB2ZXJzaW9uIGlzIDxiPjIuOS4xMS4xPC9iPjxvOnA+
PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U25vcnQgcnVu
IG9uIFVidW50dSAxNi4wNCBEb2NrZXIgY29udGFpbmVyPG86cD48L286cD48L3A+DQo8L2Rpdj4N
CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2
Pg0KPHAgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDowaW47bWFyZ2luLXJpZ2h0OjBpbjttYXJn
aW4tYm90dG9tOjEyLjBwdDttYXJnaW4tbGVmdDowaW47Ym94LXNpemluZzpib3JkZXItYm94Ij4N
CjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTAuNXB0O2ZvbnQtZmFtaWx5OiZxdW90O1NlZ29lIFVJ
JnF1b3Q7O2NvbG9yOiMyNDI5MkUiPldlIGFyZSB3b3VsZCBiZSBncmF0ZWZ1bCB0byBhbnkgYXNz
aXN0YW5jZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h
bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMC41cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7U2Vnb2Ug
VUkmcXVvdDs7Y29sb3I6IzI0MjkyRSI+VGhhbmtzITwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwv
ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0K
PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+
DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8
L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw
OzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw
PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v
OnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8
L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K

--_000_70B13184FB6A48F69FA7B6951BF90D4Cciscocom_--

--===============5214264028343079972==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!

--===============5214264028343079972==--