Question plugin Idmef-Criteria Prelude-Manager.conf

Alvaro Luis Quispe R. <[email protected]> Mon, 4 Aug 2008 19:38:44 +0000
Newsgroups gmane.comp.security.ids.prelude.devel
Message-ID <[email protected]>

Good Morning,

I configured the software prelude-manager in the company and I have the
following problem: to uncheck the option Idmef-criteria:


####################################
# Filtering plugins configuration  #
####################################

# The idmef-criteria filtering plugin allow you to filter events based
# on specific IDMEF-Criteria.
#
[idmef-criteria]
# rule = alert.classification.text == 'User login successful'
# hook = relaying[default]
rule = alert.assessment.impact.severity == highhook = db
# Will forward any events that match the defined criteria to the
# default instance of the relaying reporting plugin. The rule argument
# might also be a filename containing the rules. Example:
#

The agents are shown in prewikka offline. I do not know what to do!  Please could help me with this case?When I check de options [idmef-criteria] the agents are shown online.



Thanks,
Álvaro

_________________________________________________________________
¿Quieres los emoticonos y guiños más divertidos? Descárgate Internet Explorer 7, y consigue contenidos exclusivos cada semana. ¡Gratis!
http://www.vivelive.com/IEAK7
_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel