[Prelude Hybrid IDS] #253: Prelude Correlator: problem with unique in Event Sweep rule
"Prelude Hybrid IDS" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <[email protected]> |
#253: Prelude Correlator: problem with unique in Event Sweep rule ---------------------------------+------------------------------------------ Reporter: [email protected] | Owner: yoann Type: defect | Status: new Priority: normal | Milestone: Component: generic | Version: 0.9 Severity: normal | Keywords: ---------------------------------+------------------------------------------ When "unique: alert.target.node.address.address;" is in the EventSweep rule of the scan.rules file for Prelude Correlator, I get n/a in the Classification section of Prewikka. It is usually populated with something to the effect of: Correlation Alert (30 alerts): A single host has played the same event against multiple targets. This may be a network scan for a specific vulnerability Eventsweep When removing that chunk, everything works fine. Correlator version 0.9.0-trunk-20070717 Libprelude 0.9.14 ScottO -- Ticket URL: <https://trac.prelude-ids.org/ticket/253> Prelude Hybrid IDS <http://www.prelude-ids.org> The Prelude Hybrid Intrusion Detection System suite _______________________________________________ Prelude-devel site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-devel