Tracking session in soap header?

The logging did help. I am getting this error "HTTP_REQUEST_DATA - invalid command name findstr" then I see the SOAP message body. So I am guessing the search is not working exactly right.

 

 

Here is what the rule looks like. I did try single and double quotes.

 

 

when HTTP_REQUEST {

 

collect the payload containing the POST data

 

HTTP::collect [HTTP::header Content-Length]

 

}

 

when HTTP_REQUEST_DATA {

 

look for persistence data beginning the 59th character following the 'xmlns:soapenc=' string & ending @ "<" char

 

and follow existing persistence record or create a new one

 

persist uie [findstr [HTTP::payload] 'xmlns:soapenc=' 58 '<']

 

log local0. "[findstr[HTTP::payload] 'xmlns:soapenc=' 58 '<']"

 

}