Re: Correlator modules
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <[email protected]> |
> Actually, yes, this is the exact function that Prelude-Correlator > performs. > Prelude-Correlator is currently in development. I talked with Yoann > about the release cycle for it yesterday. There are a few more > correlation rules I want to include in the first revision of Correlator, > but otherwise it's ready to be released. > It'll probably be officially-released Prelude code in the next month. Great. :-) Can you tell me more about the way alerts are fed to Prelude-Correlator? I can read on the trac Prelude website that Prelude-Correlator "fetches alerts from a remote Prelude-manager server". Does that mean that a correlation module queries the manager for the next event to be processed on its own initiative, or is it the manager that pushes alerts to Prelude-Correlator? Ben _______________________________________________ Prelude-devel site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-devel