prelude-correlator/master: Spamhaus CorrelationAlert now handle multiples events

commit bd2ca57c54a193977ee7ecb59afed40e87c4599b
Author: Yoann Vandoorselaere <[email protected]>
Date:   Thu Nov 5 10:17:45 2009 +0100

    Spamhaus CorrelationAlert now handle multiples events
    
    Previously, we would generate a single Spamhaus CorrelationAlert for
    each events where the source address would match the Spamhaus database.
    
    The Spamhaus plugin has been modified so that it now generate
    CorrelationAlert for multiples event received from the same source.


========================================

 PreludeCorrelator/plugins/spamhausdrop.py |   13 ++++++-------
 1 files changed, 6 insertions(+), 7 deletions(-)

========================================

diff --git a/PreludeCorrelator/plugins/spamhausdrop.py b/PreludeCorrelator/plugins/spamhausdrop.py
index 85f9bb5..7e13d6c 100644
--- a/PreludeCorrelator/plugins/spamhausdrop.py
+++ b/PreludeCorrelator/plugins/spamhausdrop.py
@@ -108,10 +108,9 @@ class SpamhausDropPlugin(Plugin):
     def run(self, idmef):
         for source in idmef.Get("alert.source(*).node.address(*).address"):
             if IPAddress(source) in self.__mynets:
-                ca = IDMEF()
-                ca.addAlertReference(idmef)
-                ca.Set("alert.classification.text", "IP source matching Spamhaus DROP dataset")
-                ca.Set("alert.correlation_alert.name", "IP source matching Spamhaus DROP dataset")
-                ca.Set("alert.assessment.impact.description", "Spamhaus gathered this IP address in their DROP list - %s" % (source))
-                ca.Set("alert.assessment.impact.severity", "medium")
-                ca.alert()
+                ca = context.Context("SPAMHAUS_" + source, { "expire": 300, "alert_on_expire": True }, update = True, idmef = idmef)
+                if ca.getUpdateCount() == 0:
+                        ca.Set("alert.classification.text", "IP source matching Spamhaus DROP dataset")
+                        ca.Set("alert.correlation_alert.name", "IP source matching Spamhaus DROP dataset")
+                        ca.Set("alert.assessment.impact.description", "Spamhaus gathered this IP address in their DROP list - %s" % (source))
+                        ca.Set("alert.assessment.impact.severity", "medium")
_______________________________________________
Prelude-cvslog site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-cvslog