[Prelude Hybrid IDS] #243: user_id.name in ssh.rules - id 1913 expsoing name as "invalid"

#243: user_id.name in ssh.rules - id 1913 expsoing name as "invalid"
---------------------------------+------------------------------------------
 Reporter:  [email protected]  |       Owner:  yoann
     Type:  defect               |      Status:  new  
 Priority:  normal               |   Milestone:       
Component:  generic              |     Version:  0.9  
 Severity:  normal               |    Keywords:       
---------------------------------+------------------------------------------
 prelude-lml-0.9.8.1

 Unsure if this is intended or not, but in rule id 1913 in ssh.rules, this
 idmef field is currently set to:

 target(0).user.user_id(0).name=$2;

 which prints either illegal or invalid as opposed to the username actually
 in the syslog message, which would be exposed as:

 target(0).user.user_id(0).name=$3;

 at any rate, figured i would mention it here.

 thanks,

 scotto

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/243>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel