Re: Idmef-Criteria Prelude Filter heartbeat

 Hi Alvaro,

Rule is simple.
rule = (alert.assessment.impact.severity == high) || heartbeat

----- Original Message -----

From: "Alvaro Luis Quispe R."
To: [email protected]
Subject: [prelude-devel] Idmef-Criteria Prelude Filter heartbeat
Date: Mon, 4 Aug 2008 20:42:47 +0000



Good Morning;

I have a question;

Which is the rule in the filter [Idmef-Criteria] for filter the
heartbeats?? this,because i have the following filter:


[idmef-criteria]
rule = alert.assessment.impact.severity == high
hook = db

And the Agents Status is offline!

Best Regards,

Álvaro

-- 
Be Yourself @ mail.com!
Choose From 200+ Email Addresses
Get a Free Account at www.mail.com

_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel