Re: [Prelude Hybrid IDS] #246: New LML-Ruleset for rishi - please review
"Prelude Hybrid IDS" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <[email protected]> |
#246: New LML-Ruleset for rishi - please review
-------------------------+--------------------------------------------------
Reporter: bjou | Owner: yoann
Type: enhancement | Status: new
Priority: normal | Milestone:
Component: prelude-lml | Version: 0.9
Severity: normal | Resolution:
Keywords: |
-------------------------+--------------------------------------------------
Comment (by bjou):
Hey Yoann,
* The software does not report IPv6
* There is no rakish logging configuration, what we are interested in is
only INFO and only INFO is logged in the file we are watching
* The "Value" is in fact a custom severity. I did not investigate the
possibility of the mentioned IDMEF fields though, and unfortunately our
systems are currently down so i cannot test the ideas/changes. Same holds
for the nickname.
* NIDS fits as analyzer class
--
Ticket URL: <https://trac.prelude-ids.org/ticket/246#comment:2>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel