Re: [Prelude Hybrid IDS] #246: New LML-Ruleset for rishi - please review
"Prelude Hybrid IDS" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <[email protected]> |
#246: New LML-Ruleset for rishi - please review
-------------------------+--------------------------------------------------
Reporter: bjou | Owner: yoann
Type: enhancement | Status: new
Priority: normal | Milestone:
Component: prelude-lml | Version: 0.9
Severity: normal | Resolution:
Keywords: |
-------------------------+--------------------------------------------------
Comment (by yoann):
Thanks for this contribution!
Here are a few comments concerning the ruleset. Once the following issues
are discussed and/or fixed, we will be able to include this ruleset within
the LML distribution.
* In case the software might report Ipv6 attack, it would be best to
match the IP address using (\S+), and leaving address.category unspecified
(Prelude-Manager Normalizer will take care of setting it appropriately).
* In the ruleset regexp, the ''INFO'' keyword is matched: Is it part of
Rishi logging (and not the system logger) and won't this change depending
on the user logging configuration?
* The "Value" look like some sort of severity, would using a separate
rule to match it and set alert.assessment.impact.severity (or maybe
alert.assessment.impact.confidence) be appropriate?
* Instead of setting the nickname within AdditionalData, did you
investigate whether setting it within source/target User/UserID (with
category set to application) be appropriate?
* Not sure about the analyzer class, wouldn't NIDS fit ?
* analyzer.name should be set to Rishi (currently doesn't use an
uppercase, but the project name does).
Hope this help,
--
Ticket URL: <https://trac.prelude-ids.org/ticket/246#comment:1>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel