Re: Prelude-Correlator near releases

My production environment will be up "any day now" so that I'll have
raw, live data to work with, but I'd still like to write a set of rules
to do event proportion analysis using p0f and any sensor ("Linux hosts
generated 50% of security events yesterday, and are now generating 75%,
there might be a new 0-day"), but I haven't had time to dig into the
engine yet to discover its capabilities.
The limitation from the last engine had to do with being unable to call
an external script to read from the filesystem and pass it variables (to
parse a p0f log).
I'll probably come up with other ideas once I see my raw data, but
you're probably weeks out from me producing anything.

- Ramon

-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of Yoann
Vandoorselaere
Sent: Tuesday, August 05, 2008 6:57 AM
To: [email protected]; prelude-devel
Subject: [prelude-devel] Prelude-Correlator near releases

Hi folks,

Since first Prelude-Correlator beta was released, all of the reported
bugs where fixed, and there are no known issue anymore. We are thus
expecting to release the first stable version quickly.

Before this is done, I'd like to invite anyone who has been writing
correlation rules, to submit them so that we can include more of them in
the final Prelude-Correlator release.

Please do not hesitate to get in touch in case you have some work to
propose.

Regards,

--
Yoann Vandoorselaere | Responsable R&D / CTO | PreludeIDS Technologies
Tel: +33 (0)8 70 70 21 58                  Fax: +33(0)4 78 42 21 58
http://www.prelude-ids.com

_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel
_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel