RSA Admin

Multi table report and content 2

Discussion created by RSA Admin Employee on Apr 18, 2011
Latest reply on Apr 27, 2011 by RSA Admin

Dear Guys,



1- the new tables after content 2 are not suffcient and are missing important fields


web accounting table  vs web table (the coloum of URL is not parsed or shown if you run a query ) and if i would like to create an alert (for post HTTP method with executable content ) how Can i do This

in old web accounting table it was possible but now ????



2-i would like to know if it is possible to use mulitple tables in one report instead of one table

why i think of this

because imagine that you have an asset (web server ) and you collect IIS logs from it

now it will be much better if you can run a single report that will outline attacks generated against this website from (firewall perspective , IPS perspective , IIS perspective) instead of choosing one table at time

it would be great if there is shared variables between different tables.


and it can be very helpful for creating a consistent correaltion rule



With Warm Regards