Re: [Prelude Hybrid IDS] #206: Knowing the ruleset id generating alerts

#206: Knowing the ruleset id generating alerts
-------------------------+--------------------------------------------------
 Reporter:  toady        |        Owner:  yoann            
     Type:  enhancement  |       Status:  closed           
 Priority:  normal       |    Milestone:  Prelude-LML 0.9.9
Component:  prelude-lml  |      Version:  devel            
 Severity:  normal       |   Resolution:  fixed            
 Keywords:               |  
-------------------------+--------------------------------------------------
Comment (by yoann):

 Certain rules using variable classification.text, we wouldn't be able to
 use the ID as classification.ident since IDMEF state:

 {{{
        The "ident" attribute value MUST be unique for each particular
        combination of data identifying an object, not for each object.
        Objects may have more than one "ident" value associated with
        them.  For example, an identification of a host by name would
        have one value, while an identification of that host by address
        would have another value, and an identification of that host by
        both name and address would have still another value.
        Furthermore, different analyzers may produce different values for
        the same information.
 }}}


 Although this specific issue could be fixed, there is also another issue
 with alert generated from multiple rules, through context. Since we want
 to record all matched rules ID and revision, using AdditionalData should
 be the way to go.

 This has been implemented in [9391].

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/206#comment:4>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel