Forum Discussion
NimbostratusError message in log - CMP persist message
NimbostratusHi, it took me some time but i finally did it...
I logged the error like this:
rule Exchange_2010__oaPersistIRule {
when HTTP_REQUEST {
switch -glob [HTTP::header "User-Agent"] {
"MSRPC" {
if { [HTTP::cookie exists "OutlookSession"] } {
log local0. "HTTP::header OutlookSession is [string length [HTTP::header "OutlookSession"] ]"
persist uie [HTTP::header "OutlookSession"] 3600
} else {
log local0. "HTTP::header Authorization is [string length [HTTP::header "Authorization"]]"
persist uie [HTTP::header "Authorization"] 3600
}
}
"*Microsoft Office*" {
log local0. "HTTP::header Authorization is [string length [HTTP::header "Authorization"] ]"
persist uie [HTTP::header "Authorization"] 3600
}
default {
persist source_addr
}
}
}
I sent the qkview to the support and now wait for an answer
