prelude-correlator correlates too much
Bjoern Weiland <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <[email protected]> |
Hey guys now prelude-correlator does fine, but in my case, it correlates too much. Every few seconds it reports a possible worm activity, an eventsweep or an eventscan. What does every single correlation have in common? The "Correlated Alert" seems to be just some kind of debugging message from prelude itsself, having the format: # Invalid analyzerid:messageid pair: 1406654493932982:52640287451761 # Invalid analyzerid:messageid pair: 1406654493932982:52640287451761 ... Now is there something misconfigured on my side or how can one avoid this problem? -regards, bjoern _______________________________________________ Prelude-devel site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-devel