log response ASM cookies

Hi Tal,

Having ASM shouldn't actually change how you do this. You can look in the response for cookies starting with TS. Here is an example:

when HTTP_RESPONSE {
    only look for TS cookies if it's a response to the specific client
   if {[IP::addr [IP::client_addr] equals 1.2.3.4]}{
       loop through cookie names 
      foreach aCookie [HTTP::cookie names] {
          log cookie names and values that start with TS
         if { $aCookie starts_with "TS"}{
            log local0. "client: [IP::client_addr] has cookie $aCookie=[HTTP::cookie value $aCookie]"
         }
      }
   }
}

Aaron