Forum Discussion
MDPF52_180608
Nimbostratus
NimbostratusiRule inspecting body response
Hello Devcentral community,
How i can detect if the following content of the HTTP BODY is present in the HTTP RESPONSE ?
the following line :
this.location.replace ("
Thanks in a...
giltjrNimbostratus
NimbostratusI think you can do something like:
STREAM::disable
STREAM::expression "this.location.replace("https://"
STREAM::enable
Then use the STREAM_MATCHED event:
when STREAM_MATCHED {
log local0. "Stream found."
}
You may need to play with it some, I can't remember exactly how to do this, but it can be done. You can search with stream and then NOT replace.
