Re: Correlator throwing "Invalid input value"

On 11/02/2010 01:37 PM, Kaplan, Michael A wrote:
> Thank you for the response! I stumbled on this fact as well when I was
> looking through the change logs for the idmef.py file. I did try the patc=
h to
> 0.9-beta (as well as compiling and running Prelude Correlator 1.0.0). Both
> "worked" with the fix.

OK :-)

> =

> The one thing I was still surprised by, however, was that the correlated
> alerts listed N sources in the alert.source field where N is the number of
> alerts correlated (even if there were duplicates). For example, if all 30
> individual alerts come from the same source, the EventScan alert shows 30
> sources in the alert.source idmef structure. I want each unique entry to
> appear only once, so I added some of my own code to do this. I would have
> thought the Match function would do this for me, but I think it may not
> compare lists properly.
> =


But you don't have this bug with Prelude Correlator version 1.0.0, have you=
 ?

BR,

Fr=E9d=E9ric Yhuel
_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-devel