Re: Question plugin Idmef-Criteria Prelude-Manager.conf

It looks like your filter is too percise
keep in mind that the prewikka frontend uses the hearbeats to determin if th agents are online. To prelude's components the heartbeat is just an other kind of alert. In short your  rule is currently filtering out your heartbeats so prewikka think your agents are offline.

-----------------------
Sent from my Treo(r) smartphone

-----Original Message-----
From: Alvaro Luis Quispe R. <[email protected]>
Date: Monday, Aug 4, 2008 3:43 pm
Subject: [prelude-devel] Question plugin Idmef-Criteria Prelude-Manager.conf
To: <[email protected]>



Good Morning,

I configured the software prelude-manager in the company and I have the
following problem: to uncheck the option Idmef-criteria:


####################################
# Filtering plugins configuration  #
####################################

# The idmef-criteria filtering plugin allow you to filter events based
# on specific IDMEF-Criteria.
#
[idmef-criteria]
# rule = alert.classification.text == 'User login successful'
# hook = relaying[default]
rule = alert.assessment.impact.severity == highhook = db
# Will forward any events that match the defined criteria to the
# default instance of the relaying reporting plugin. The rule argument
# might also be a filename containing the rules. Example:
#

The agents are shown in prewikka offline. I do not know what to do!  Please could help me with this case?When I check de options [idmef-criteria] the agents are shown online.



Thanks,
Álvaro

_________________________________________________________________
¿Quieres los emoticonos y guiños más divertidos? Descárgate Internet Explorer 7, y consigue contenidos exclusivos cada semana. ¡Gratis!
http://www.vivelive.com/IEAK7
_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel

_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel