sagan
sagan copied to clipboard
beave
xbit to track usernames.
From Steve:
"Create flowbits based on anything found in a log. For instance, pull a username from a log and create a flowbit named the same as the username (user bob would have a flowbit called "bob"). Idea is to be able to track the DC a user normally logs into and alert when they log into a different DC."
