prelude-correlator/master: Do not generate CorrelationAlert for multiples successful authentication

commit 3472e42c3fc5ba30d3cc32cf985a4250f9b731f1
Author: Yoann Vandoorselaere <[email protected]>
Date:   Tue Mar 16 12:20:59 2010 +0100

    Do not generate CorrelationAlert for multiples successful authentication
    
    The current BruteForce plugin implementation was generating Correlation
    Event for multiples, successfull login events.
    
    In the future, we might want to include successfull authentication following
    a number of failed events, so that generated CorrelationAlert includes full
    details.


========================================

 PreludeCorrelator/plugins/bruteforce.py |    6 ++++++
 1 files changed, 6 insertions(+), 0 deletions(-)

========================================

diff --git a/PreludeCorrelator/plugins/bruteforce.py b/PreludeCorrelator/plugins/bruteforce.py
index 8a0196a..ae2966a 100644
--- a/PreludeCorrelator/plugins/bruteforce.py
+++ b/PreludeCorrelator/plugins/bruteforce.py
@@ -55,5 +55,11 @@ class BruteForcePlugin(Plugin):
         if not idmef.match("alert.classification.text", re.compile("[Ll]ogin|[Aa]uthentication")):
             return
 
+        # FIXME: In the future, we might want to include successfull authentication
+        # following a number of failed events, so that generated CorrelationAlert
+        # includes full details.
+        if idmef.Get("alert.assessment.impact.completion") == "succeeded":
+            return
+
         self._BruteForce(idmef)
         self._BruteUserForce(idmef)
_______________________________________________
Prelude-cvslog site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-cvslog