Re: Prelude and Sguil capabilities

On Tue, 2006-11-21 at 10:57 +0100, Robin Gruyters wrote:
> Quoting Yoann Vandoorselaere <[email protected]>:
> 
> > On Tue, 2006-11-21 at 10:02 +0100, Robin Gruyters wrote:
> >> Quoting Yoann Vandoorselaere <[email protected]>:
> >> > On Fri, 2006-11-10 at 16:42 +0100, Robin Gruyters wrote:
> >> >> - Save full packets in tcpdump format; (which we already have
> >> >>   up-and-running)
> >> >
> >> > Modifying Snort so that it attach the full packet data, and having
> >> > Prewikka able to print the headers (as is currently done, but
> >> > differently) potentially sound like a good idea.
> >> >
> >> > Did you actually tried it? If you did, I'd like to hear about it.
> >> >
> >> Well like I said, we already have this done, but we have done it with
> >> tcpdump(8) not with Snort. I don't like the idea to use Snort for
> >> Alerts as well for full packet logging. (e.g. security issues with
> >> Snort)
> >
> > Could you elaborate ?
> >
> Well in the past we had some issues with Snort that it just dies, with  
> no error messages. If you use Snort for Alerts and for full packet  
> logging, then both processes will die, so you don't have *any* alerts  
> or packet logging. That for me is a big no, no.

How did it die exactly?

> >> >> - Add more external command; (p0f, tcpdump, etc)
> >> >
> >> > Since Prewikka 0.9.7, you can run any command out of Prewikka, so you
> >> > might want to check this out.
> >> >
> >> What arguments are possible to use with the external command? Only
> >> $host? I can't find any documentation about this...
> >
> > It's described in the Prewikka template configuration file:
> >
> > [host_commands]
> > #
> > # You can use the $host variable that will be substituted with
> > # the source/target host value.
> > #
> > #MyCommand: /path/to/command <parameters>
> > #Command Title: /usr/bin/test -x $host -a
> >
> > If you need more substitution parameters, feel free to suggest them on
> > trac.prelude-ids.com.
> >
> Ok, coz I want to have at least:
> - src host
> - dst host
> - src port
> - dst port
> - timestamp

Could you create a ticket for this, as well as an example of how each
field is going to be useful to you?

Regards,

-- 
Yoann Vandoorselaere <[email protected]>

_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel