[Prelude Hybrid IDS] #210: Group classification.text together

#210: Group classification.text together
-------------------------+--------------------------------------------------
 Reporter:  yoann        |       Owner:  toady
     Type:  enhancement  |      Status:  new  
 Priority:  normal       |   Milestone:       
Component:  brouette     |     Version:  0.9  
 Severity:  major        |    Keywords:       
-------------------------+--------------------------------------------------
 Currently a notification is done for each alert, making ''brouette''
 difficult to use in case of burst.

 It would be nice to group notification together when the same
 classification is received multiple time. Here is a small description of
 how this could be done:

  * '''now''': Current time
  * '''first_received''': Time when the first alert with this
 classification was received.
  * '''count''': Number of time this classification was received, before
 the user was "notified".
  * '''max_wait_time''': Max number of seconds to wait before notifying the
 user (5 seconds look like a good default).

  * Create a hash of "known" classification.

  * When we receive an alert, check whether it is in the classification
 hash.
   - In case it is:
    - Set ''count'' = ''count'' + 1.
    - If (''now'' - ''first_received'') >= ''max_wait_time'': emit
 notification (including ''count''), destroy timer and hash entry.
   - In case it is not:
    - Create a hash entry for this classification.
    - Set ''first_received'' to ''now''.
    - Set ''count'' = 1.
    - Setup a timer that will expire after ''max_wait_time'' seconds, to
 notify the user in case we get no further alert with this classification.

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/210>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel