Re: Correlator throwing "Invalid input value"

Thank you for the response! I stumbled on this fact as well when I was look=
ing through the change logs for the idmef.py file. I did try the patch to 0=
.9-beta (as well as compiling and running Prelude Correlator 1.0.0). Both "=
worked" with the fix. =


The one thing I was still surprised by, however, was that the correlated al=
erts listed N sources in the alert.source field where N is the number of al=
erts correlated (even if there were duplicates). For example, if all 30 ind=
ividual alerts come from the same source, the EventScan alert shows 30 sour=
ces in the alert.source idmef structure. I want each unique entry to appear=
 only once, so I added some of my own code to do this. I would have thought=
 the Match function would do this for me, but I think it may not compare li=
sts properly. =


Mike =


-----Original Message-----
From: [email protected] [mailto:prelude-devel-=
[email protected]] On Behalf Of Frederic Yhuel
Sent: Tuesday, November 02, 2010 6:05 AM
To: [email protected]
Subject: Re: [prelude-devel] Correlator throwing "Invalid input value"

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/27/2010 10:00 PM, Kaplan, Michael A wrote:
> I'm running PreludeCorrelator on Ubuntu. In idmef.py, I am getting a "Inv=
alid input value" exception on the line:
> =

> Self.Set("alert.source(>>)", idmef.Get("alert.source).
> =

> I have not modified this code in any way. Any ideas why I might be encoun=
tering this?
> =


Hello Mike,

Sorry for the delay, actually I replied Friday but I had a problem with the
mailing list.

Your problem reminds me a bug I have reported (and corrected):

http://lists.prelude-technologies.com/pipermail/prelude-cvslog/2010-March/0=
12958.html

Could you apply the patch and see if it removes your problem ?

BR,
Fr=E9d=E9ric
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkzP4l0ACgkQtSKJdydwoCpxswCbBw/+ekOaTdtnU2BeHXpx8HI1
CyQAn1WbycO2Csc0z0ZzUkWtKG2OF6MI
=3DsvCh
-----END PGP SIGNATURE-----
_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-devel
_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-devel