prelude-correlator/master: Ability to specify an input IDMEF criteria

commit c32aaa02f3f6bde99c9e30d5b30fc5f0ed113870
Author: Yoann Vandoorselaere <[email protected]>
Date:   Wed May 5 12:14:34 2010 +0200

    Ability to specify an input IDMEF criteria
    
    There is now a [general] configuration section in prelude-correlator.conf
    allowing to specify a criteria option that use an IDMEF criteria parameter
    as an argument.
    
    Using this option, it is possible to specify an input filter for events
    to be processed by the correlator.
    
    Additionally, always use an IDMEFCriteria to check whether the input
    event is an alert, in place of manually retrieving alert.create_time.


========================================

 PreludeCorrelator/main.py |   22 +++++++++++++++++-----
 prelude-correlator.conf   |   10 ++++++++++
 2 files changed, 27 insertions(+), 5 deletions(-)

========================================

diff --git a/PreludeCorrelator/main.py b/PreludeCorrelator/main.py
index 1a6db50..b645dcb 100644
--- a/PreludeCorrelator/main.py
+++ b/PreludeCorrelator/main.py
@@ -22,7 +22,7 @@
 import require
 import sys, os, time, signal
 from optparse import OptionParser
-from PreludeEasy import ClientEasy, CheckVersion
+from PreludeEasy import ClientEasy, CheckVersion, IDMEFCriteria
 from PreludeCorrelator import __version__ as VERSION
 from PreludeCorrelator import idmef, pluginmanager, context, log, config
 
@@ -94,17 +94,29 @@ class PreludeClient:
                 if self._print_output:
                         self._print_output.write(str(idmef))
 
-        def recvEvent(self):
+        def recvEvents(self):
+                criteria = env.config.get("general", "criteria")
+                if criteria:
+                    criteria = "alert && (%s)" % (criteria)
+                else:
+                    criteria = "alert"
+
+                try:
+                    criteria = IDMEFCriteria(criteria)
+                except Exception, e:
+                    env.logger.error("Error processing criteria '%s': %s" % (criteria, e))
+                    raise
+
                 last = time.time()
                 while self._continue:
                         try:
                             msg = idmef.IDMEF()
                             r = self._client.RecvIDMEF(msg, 1000)
                         except:
-                                r = 0
+                            r = 0
 
                         if r:
-                                if msg.Get("alert.create_time"):
+                                if criteria.Match(msg):
                                         self._handle_event(msg)
 
                         now = time.time()
@@ -175,7 +187,7 @@ def main():
         # restore previous context.
         context.load()
 
-        env.prelude_client.recvEvent()
+        env.prelude_client.recvEvents()
 
         # save existing context
         context.save()
diff --git a/prelude-correlator.conf b/prelude-correlator.conf
index ca7f777..fea6efb 100644
--- a/prelude-correlator.conf
+++ b/prelude-correlator.conf
@@ -1,5 +1,15 @@
 # This is a template configuration file for prelude-correlator
 #
+
+[general]
+#
+# Only attempt to correlate input events that match the following criteria:
+# criteria =
+
+
+# Plugin configuration:
+#
+
 # [BruteForcePlugin]
 # disable = false
 #
_______________________________________________
Prelude-cvslog site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-cvslog