Forum Discussion
Hurting eyes, could someone check this?
Hey all,
Running 9.0.5, I have these rules in place:
rule cyclone_ftp_hhtp_request {
when HTTP_REQUEST {
if { [HTTP::uri] contains "ftp" } {
node 192.168.250.144...
Yeah, you'll want to use [TCP::local_port]!
