Forum Discussion
djzoidberg_2313
Jan 20, 2015Nimbostratus
Hi, I'm using this rule, how I can convert that?
when ACCESS_SESSION_STARTED { log local0. " - Session started" set domain "DOMAIN\" if {([HTTP::uri] contains "DOMAIN")} { regexp "User=DOMAIN%5C([a-zA-Z0-9]+)" [HTTP::uri] all user set username $user ACCESS::session data set session.custom.username $username ACCESS::session data set session.custom.domain.and.username $domain$username log local0. " - Variables | $username | $domain$username" } }