Correlator modules

Hi,

I would like to plug an alert correlation module with the prelude framework in
order to process alerts streams in "real-time", i.e. without requesting alert
database periodically. This module would both act as a manager and a sensor,
because it receives alerts from sensors and sends higher-level alerts to another
manager.

I am currently planning to implement this correlation module as a manager
reporting plugin with sensor capabilities... Does that sound correct? Are there
tutorials, howtos, etc. for doing that kind of thing?

Thanks for your replies,

Ben


_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel