Re: [Prelude Hybrid IDS] #216: mod_security cleanup, and compatibility with version 2.0

#216: mod_security cleanup, and compatibility with version 2.0
-------------------------+--------------------------------------------------
 Reporter:  gegomez      |        Owner:  Peter Vrabec <[email protected]>
     Type:  defect       |       Status:  assigned                         
 Priority:  normal       |    Milestone:  Prelude-LML 0.9.13               
Component:  prelude-lml  |      Version:  0.9                              
 Severity:  normal       |   Resolution:                                   
 Keywords:               |  
-------------------------+--------------------------------------------------

Comment(by yoann):

 Replying to [comment:7 [email protected]]:
 > we appreciate any feedback on our mod_security 2.0 ruleset  attached by
 [email protected].

 Thanks! could you update the ruleset to include some log sample, using the
 following syntax:
 {{{
 #LOG:May 10 15:19:28 mail clamd[14292]:
 /usr/share/doc/clamav-0.70/test/test2.badext: ClamAV-Test-Signature FOUND
 }}}


 This is used for regression testing and reviewing generated alerts:
 {{{
   cd prelude-lml/tests
   ./loggrep.py ../plugins/pcre/ruleset/<name of your ruleset>.rules |
 ../src/prelude-lml --dry-run --metadata=nowrite,head --batch-mode --no-
 resolve --pcre --dump-unmatched --config ./prelude-lml.conf --text-output
 }}}

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/216#comment:10>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel