Re: Idmef-Criteria Prelude Filter heartbeat

Yoann Vandoorselaere <[email protected]> Tue, 05 Aug 2008 16:30:07 +0200

Newsgroups	gmane.comp.security.ids.prelude.devel
Message-ID	<1217946607.18906.26.camel@arwen>

Hi,

Le lundi 04 août 2008 à 20:42 +0000, Alvaro Luis Quispe R. a écrit :
> Good Morning;
> 
> I have a question;
> 
> Which is the rule in the filter [Idmef-Criteria] for filter the heartbeats?? this,because i have the following filter: 
> 
> 
> [idmef-criteria]
> rule = alert.assessment.impact.severity == high
> hook = db

You can use the following rule:
heartbeat || alert.assessment.impact.severity == high

Which mean: report any heartbeat, or alert with high severity.

Regards,

-- 
Yoann Vandoorselaere | Responsable R&D / CTO | PreludeIDS Technologies
Tel: +33 (0)8 70 70 21 58                  Fax: +33(0)4 78 42 21 58
http://www.prelude-ids.com

_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel