Re: Correlator modules
"Gene Ramon Gomez" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <622FD37285F1584386F5F83D9D233C9C3963ED@SMF-ENTXM-001.sac.ragingwire.net> |
Actually, yes, this is the exact function that Prelude-Correlator performs. Prelude-Correlator is currently in development. I talked with Yoann about the release cycle for it yesterday. There are a few more correlation rules I want to include in the first revision of Correlator, but otherwise it's ready to be released. It'll probably be officially-released Prelude code in the next month. - Ramon -----Original Message----- From: [email protected] [mailto:[email protected]] Sent: Tuesday, January 30, 2007 11:59 AM To: Gene Ramon Gomez Cc: [email protected] Subject: RE: [prelude-devel] Correlator modules > Ah. So this is different from Prelude-Correlator because you hope to > have sensors report to this directly (emulating a Prelude-Manager > system), then have this relay correlated events to an actual > Prelude-Manager system? Well, actually, not really. What I want is to have a component that is able to receive alerts from a manager, and send correlated alerts back to it (or other managers). I was not aware of the Prelude-Correlator component (I could not find a link to it from the trac main page)... It seems that Prelude-Correlator does this, doesn't it? Ben _______________________________________________ Prelude-devel site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-devel