Re: Correlator modules
Olaf Gellert <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <[email protected]> |
[email protected] wrote: >> Ah. So this is different from Prelude-Correlator because you hope to >> have sensors report to this directly (emulating a Prelude-Manager >> system), then have this relay correlated events to an actual >> Prelude-Manager system? > > Well, actually, not really. What I want is to have a component that is able to > receive alerts from a manager, and send correlated alerts back to it (or other > managers). You might have a look at the sources of the relay plugin (coming with prelude-manager). It receives alerts and forwards them (with almost no processing) to another manager... Could be a good base for your implementation. Olaf -- Dipl.Inform. Olaf Gellert INTRUSION-LAB.NET Senior Researcher, www.intrusion-lab.net PKI - and IDS - Services [email protected] _______________________________________________ Prelude-devel site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-devel