Re: [Prelude Hybrid IDS] #206: Knowing the ruleset id generating alerts
"Prelude Hybrid IDS" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <[email protected]> |
#206: Knowing the ruleset id generating alerts
-------------------------+--------------------------------------------------
Reporter: toady | Owner: yoann
Type: enhancement | Status: assigned
Priority: normal | Milestone: Prelude-LML 0.9.9
Component: prelude-lml | Version: devel
Severity: normal | Resolution:
Keywords: |
-------------------------+--------------------------------------------------
Changes (by yoann):
* cc: [email protected] (added)
* status: new => assigned
* milestone: => Prelude-LML 0.9.9
Comment:
There are two solutions to this problem, either add the ID to an
additional_data field, otherwise use classification.ident. However, the
later is only valid if we are 100% sure that rules can not generate alert
for multiple classification. Ramon is the LML ruleset maintainer, he might
have interesting opinion to share on this topic.
--
Ticket URL: <https://trac.prelude-ids.org/ticket/206#comment:1>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel