Question plugin Idmef-Criteria Prelude-Manager.conf
Alvaro Luis Quispe R. <[email protected]> Mon, 4 Aug 2008 19:38:44 +0000
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <[email protected]> |
Good Morning, I configured the software prelude-manager in the company and I have the following problem: to uncheck the option Idmef-criteria: #################################### # Filtering plugins configuration # #################################### # The idmef-criteria filtering plugin allow you to filter events based # on specific IDMEF-Criteria. # [idmef-criteria] # rule = alert.classification.text == 'User login successful' # hook = relaying[default] rule = alert.assessment.impact.severity == highhook = db # Will forward any events that match the defined criteria to the # default instance of the relaying reporting plugin. The rule argument # might also be a filename containing the rules. Example: # The agents are shown in prewikka offline. I do not know what to do! Please could help me with this case?When I check de options [idmef-criteria] the agents are shown online. Thanks, Álvaro _________________________________________________________________ ¿Quieres los emoticonos y guiños más divertidos? Descárgate Internet Explorer 7, y consigue contenidos exclusivos cada semana. ¡Gratis! http://www.vivelive.com/IEAK7 _______________________________________________ Prelude-devel site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-devel