prelude-correlator/master: Correctly set CorrelationAlert DetectTime

commit 0f1b91eb9904512d49b368c2b757ec45491584c2
Author: Yoann Vandoorselaere <[email protected]>
Date:   Sun Jan 10 15:17:06 2010 +0100

    Correctly set CorrelationAlert DetectTime
    
    Modify addAlertReference() so that the reported CorrelationAlert
    DetectTime match the time of the first event that was detected.
    
    From IDMEF RFC 4765, section 4.2.2:
    DetectTime
    
    The time the event(s) leading up to the alert was detected. In the case
    of more than one event, the time the first event was detected.  In some
    circumstances, this may not be the same value as CreateTime.


========================================

 PreludeCorrelator/idmef.py |   15 ++++++++++++++-
 PreludeCorrelator/main.py  |    2 +-
 2 files changed, 15 insertions(+), 2 deletions(-)

========================================

diff --git a/PreludeCorrelator/idmef.py b/PreludeCorrelator/idmef.py
index 42f87a2..7b4ca69 100644
--- a/PreludeCorrelator/idmef.py
+++ b/PreludeCorrelator/idmef.py
@@ -46,6 +46,13 @@ class IDMEF(PreludeEasy.IDMEF):
 
                 return odict
 
+        def getTime(self):
+                itime = self.Get("alert.detect_time")
+                if not itime:
+                        itime = self.Get("alert.create_time")
+
+                return itime
+
         def Get(self, path, flatten=True, replacement=None):
                 path = PreludeEasy.IDMEFPath(path)
 
@@ -118,7 +125,13 @@ class IDMEF(PreludeEasy.IDMEF):
                 global prelude_client
                 prelude_client.correlationAlert(self)
 
-        def addAlertReference(self, idmef):
+        def addAlertReference(self, idmef, auto_set_detect_time=True):
+                if auto_set_detect_time is True:
+                    intime = idmef.getTime()
+                    curtime = self.getTime()
+                    if (not curtime) or intime < curtime:
+                        self.Set("alert.detect_time", intime)
+
                 self.Set("alert.source(>>)", idmef.Get("alert.source"))
                 self.Set("alert.target(>>)", idmef.Get("alert.target"))
                 self.Set("alert.correlation_alert.alertident(>>).alertident", idmef.Get("alert.messageid"))
diff --git a/PreludeCorrelator/main.py b/PreludeCorrelator/main.py
index e3fe9bb..d65040a 100644
--- a/PreludeCorrelator/main.py
+++ b/PreludeCorrelator/main.py
@@ -27,7 +27,7 @@ from PreludeCorrelator import __version__ as VERSION
 from PreludeCorrelator import idmef, pluginmanager, context, log, config
 
 
-LIBPRELUDE_REQUIRED_VERSION = "0.9.23"
+LIBPRELUDE_REQUIRED_VERSION = "0.9.25"
 
 
 class Env:
_______________________________________________
Prelude-cvslog site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-cvslog