[Prelude Universal SIM system] #316: More specific grouping of events in prewikka console

#316: More specific grouping of events in prewikka console
-----------------------------+----------------------------------------------
 Reporter:  Shurick          |        Type:  enhancement
   Status:  new              |    Priority:  normal     
Milestone:  Prewikka 0.9.15  |   Component:  prewikka   
  Version:  0.9              |    Severity:  normal     
 Keywords:                   |  
-----------------------------+----------------------------------------------
 Current prewikka console groups together the events that has same
 alert.source.{node-name, node-addr} and/or alert.target.{node-name, node-
 addr} defined. Buf if both fields don't exist (prewikka displays them as
 n/a) then all alerts are placed in the single table 'row'. This looks
 terrible if you have several hundreds sensors or even more.

 So I suggest to group them by alert.analyzer.node-name using the node-name
 of analyzer closest to the source of alert (usually this one is the host
 where an alert happened).

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/316>
Prelude Universal SIM system <http://www.prelude-ids.com>
Prelude Universal SIM system
_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel