reyjrar/ossec-hids — pull request #1 by reyjrar (2014-04-30 13:53:55+00:00)
Title: Accumulator (Multi-line message parsing using IDs)

As described in this write-up: [OSSEC-HIDS Accumulator](http://edgeofsanity.net/article/2012/11/26/ossec-hids-accumulator.html)

This code has been in production with > 2048 agents for over 12 months now.