Re: How to Print Alert in XML Format

Folks,

I investigated a bit further and found that the IDMEF objects in the PreludeCorrelator are ultimately passed through the function SendIDMEF in main.py.  As I continued to trace this call, it looks like the prelude c/c++ libraries receive this IDMEF object and likely convert it to XML and send it to the prelude manager. I want to send it to a location other than the prelude manager. Any ideas on how I could do this? Is there a way to convert he IDMEF to XML in the Correlator itself?

Mike

From: Kaplan, Michael A
Sent: Tuesday, December 21, 2010 12:28 PM
To: [email protected]
Subject: How to Print Alert in XML Format

Folks,

I have an IDMEF alert that I created in Prelude Correlator by creating a fresh idmef.IDMEF() object and then setting the properties I care about. I then want to send this IDMEF message to another process expecting to receive the alert in XML format. When I print my object, however, it looks like it is formatted in some way, but I don't see the XML tags.  Is there a way to put the IDMEF alert in XML format? My code:

msg = idmef.IDMEF()
msg.Set("version", "1.0")
msg.Set("alert.assessment.impact.severity", "medium")
etc...
etc...

Then some socket logic to send the msg objcet. I need this object to be in XML format and by default it doesn't look XML.

Thanks,

Mike


_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-devel