1- the new tables after content 2 are not suffcient and are missing important fields
web accounting table vs web table (the coloum of URL is not parsed or shown if you run a query ) and if i would like to create an alert (for post HTTP method with executable content ) how Can i do This
in old web accounting table it was possible but now ????
2-i would like to know if it is possible to use mulitple tables in one report instead of one table
why i think of this
because imagine that you have an asset (web server ) and you collect IIS logs from it
now it will be much better if you can run a single report that will outline attacks generated against this website from (firewall perspective , IPS perspective , IIS perspective) instead of choosing one table at time
it would be great if there is shared variables between different tables.
and it can be very helpful for creating a consistent correaltion rule
With Warm Regards