Re: [Prelude Hybrid IDS] #216: mod_security cleanup, and compatibility with version 2.0

#216: mod_security cleanup, and compatibility with version 2.0
-------------------------+--------------------------------------------------
 Reporter:  gegomez      |        Owner:  Peter Vrabec <[email protected]>
     Type:  defect       |       Status:  assigned                         
 Priority:  normal       |    Milestone:  Prelude-LML 0.9.13               
Component:  prelude-lml  |      Version:  0.9                              
 Severity:  normal       |   Resolution:                                   
 Keywords:               |  
-------------------------+--------------------------------------------------

Comment(by yoann):

 Replying to [comment:17 dkopecek@…]:
 > Replying to [comment:16 yoann]:
 > > Overall, the generated alert look good! Here are some feedback &
 questions:
 > >
 > >  * IDMEF require the Reference name and url to not be empty.
 >
 > See last attachment.

 [[BR]]
 Thanks, this fixed both this and the unique identifier problem!
 [[BR]]



 > >  * What is ModSec Rule ID?
 >
 > This is the ID of the mod_security rule that generated the log entry.

 [[BR]]
 Is the RuleID tied to the "msg" part of the log (aka: one ID per msg)?

 I am wondering whether we should use the "msg" part directly within
 classification.text. How many different msg are there in current
 ModSecurity rules? Do you have any opinion on the matter?
  [[BR]]

 > >  * What is UniqueID?
 >
 > I don't know what this is exactly, but I think that apache identifies
 sessions with this. mod_unique_id is a separate apache module and
 mod_security requires it.

 [[BR]]
 Thanks, so this can remain in AdditionalData.
 [[BR]]

 > >  * What exactly is the log format used in the ruleset log sample
 (doesn't look like raw log entry, there is no timestamp)?
 >
 > I changed the format back to the version with timestamp (apache
 error_log). See last attachment.

 [[BR]]
 Excellent, now we can run make tests on the ruleset, the alert are
 generated and there seems to be no regression!
 [[BR]]

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/216#comment:18>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel