Re: [Prelude Hybrid IDS] #191: Group by user broken
"Prelude Hybrid IDS" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <[email protected]> |
#191: Group by user broken
-----------------------+----------------------------------------------------
Reporter: anonymous | Owner: yoann
Type: defect | Status: assigned
Priority: normal | Milestone: Prewikka 0.9.9
Component: prewikka | Version: 0.9
Severity: normal | Resolution:
Keywords: |
-----------------------+----------------------------------------------------
Comment (by [email protected]):
Problem is consistently appearing. The rule that is causing the problem is
written by me but I've also tested it with a wu-ftpd rule which causes the
same problem.
Sensors is LML 0.9.7. I have just updated the system to 0.9.8.1. Rule is
alerting on OpenVPN logins. Source info from dbadmin print below
analyzer(2):
name: OpenVPN
manufacturer: OpenVPN
class: Remote Login
node:
category: unknown (0)
name: host.name
address(0):
category: ipv4-addr (7)
address: 172.16.10.241
process:
name: openvpn
pid: 18983
create_time: 10/01/2007 08:33:52.245259 +13:00
classification:
text: Remote user logged in
detect_time: 10/01/2007 08:33:52.0 +13:00
analyzer_time: 10/01/2007 08:33:52.245313 +13:00
source(0):
spoofed: unknown (0)
node:
category: unknown (0)
address(0):
category: ipv4-addr (7)
address: 1.1.1.1
user:
category: os-device (2)
user_id(0):
type: current-user (1)
name: User_Name
--
Ticket URL: <https://trac.prelude-ids.org/ticket/191#comment:2>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel