Re: Correlator modules

Ah.  So this is different from Prelude-Correlator because you hope to
have sensors report to this directly (emulating a Prelude-Manager
system), then have this relay correlated events to an actual
Prelude-Manager system?
While I understand your goal, such a solution wouldn't be very scalable.
For instance, you would have difficulties providing multiple geographic
locations with local reporting and correlation capabilities, while still
doing global-level correlation without duplicating alert streams (since
anywhere you'd be running correlation you'd consume the atomic alerts
and only emit correlated alerts).
However, if you're set on developing this, I'd first suggest you
consider using Prelude-Correlator for the work and work with Yoann to
patch it to do what you're asking for, as well as what it does now (ride
alongside Prelude-Manager).

- Ramon 

-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of
[email protected]
Sent: Tuesday, January 30, 2007 4:55 AM
To: [email protected]
Subject: [prelude-devel] Correlator modules

Hi,

I would like to plug an alert correlation module with the prelude
framework in order to process alerts streams in "real-time", i.e.
without requesting alert database periodically. This module would both
act as a manager and a sensor, because it receives alerts from sensors
and sends higher-level alerts to another manager.

I am currently planning to implement this correlation module as a
manager reporting plugin with sensor capabilities... Does that sound
correct? Are there tutorials, howtos, etc. for doing that kind of thing?

Thanks for your replies,

Ben


_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel
_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel