prelude-correlator/master: Worm plugin CorrelationAlert was missing a reference to the initial event

commit eff07e086cf3bbbd16763f45a7d87c8ccbe08119
Author: Yoann Vandoorselaere <[email protected]>
Date:   Thu Oct 29 11:23:07 2009 +0100

    Worm plugin CorrelationAlert was missing a reference to the initial event


========================================

 PreludeCorrelator/plugins/worm.py |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

========================================

diff --git a/PreludeCorrelator/plugins/worm.py b/PreludeCorrelator/plugins/worm.py
index 7609be7..849e031 100644
--- a/PreludeCorrelator/plugins/worm.py
+++ b/PreludeCorrelator/plugins/worm.py
@@ -34,6 +34,7 @@ class WormPlugin(Plugin):
         # Create context for classification combined with all the target.
         for target in idmef.Get("alert.target(*).node.address(*).address"):
             ctx = context.Context("WORM_HOST_" + ctxt + target, { "expire": 300, "threshold": 5 }, update = True)
+            ctx.addAlertReference(idmef)
 
         for source in idmef.Get("alert.source(*).node.address(*).address"):
             # We are trying to see whether a previous target is now attacking other hosts
_______________________________________________
Prelude-cvslog site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-cvslog