Re: [Prelude Universal SIM system] #332: Error about missing arguments in prelude-correlator lua ruleset

#332: Error about missing arguments in prelude-correlator lua ruleset
------------------------------------------+---------------------------------
 Reporter:  jerome.benoit@…               |        Type:  defect            
   Status:  new                           |    Priority:  normal            
Milestone:  Prelude-Correlator 0.9.0      |   Component:  prelude-correlator
  Version:  0.9                           |    Severity:  normal            
 Keywords:                                |  
------------------------------------------+---------------------------------

Comment(by yoann):

 Could you check that the currently installed rule look like the following:

 {{{
 function business_hour(INPUT)

 local t = INPUT:get("alert.create_time")
 local is_succeeded = INPUT:match("alert.assessment.impact.completion",
 "succeeded")

 -- Run this code only on saturday (1) and sunday (6), or from 6:00pm to
 9:00am.
 if is_succeeded and (t.wday == 1 or t.wday == 6 or t.hour < 9 or t.hour >
 18) then
         local ca = IDMEF.new()

         ca:set("alert.source", INPUT:getraw("alert.source"))
         ca:set("alert.target", INPUT:getraw("alert.target"))
         ca:set("alert.classification",
 INPUT:getraw("alert.classification"))
         ca:set("alert.correlation_alert.alertident(>>).alertident",
 INPUT:getraw("alert.messageid"))
         ca:set("alert.correlation_alert.alertident(-1).analyzerid",
 INPUT:getAnalyzerid())
         ca:set("alert.correlation_alert.name", "Critical system activity
 on day off")
         ca:alert()
 end

 end
 }}}

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/332#comment:3>
Prelude Universal SIM system <http://www.prelude-ids.com>
Prelude Universal SIM system
_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel