Re: How to Print Alert in XML Format

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--===============8839257046549583746==
Content-Type: multipart/signed; protocol="application/pgp-signature"; micalg=pgp-sha1; boundary="Apple-Mail-7--952356031"
Content-Transfer-Encoding: 7bit

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--Apple-Mail-7--952356031
Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes
Content-Transfer-Encoding: 7bit

iirc:

they serialize the idmef object within the c-lib (binary object, not  
xml) and then xfer that to the manager (much faster). It's never  
really xml cause the idmef objects are all manipulated in memory.

I think they provide the binary-blob <--> xml converter as part of  
their commercial offering though.

a neat feature might be to re-write the libprelude using google  
protocol buffers, making it easier to deal with this sort of thing...  
right now, you'd need to write your own c-implementation of IDMEF that  
prints out the XML, depending on where you want the XML to pop out  
from. Not terribly hard to do if you have some time on your hands...  
With this, you could also leverage other messaging standards such as  
IODEF, ICSG, NMSG, and start making your managers more intelligent  
with other types of data (threat rep feeds, malware repo's, etc). For  
that you'd need to start overhauling the libpreludedb code too though  
to warehouse the raw messages (rather than just the overnormalized  
idmef stuff)... but that's a different thread for a different day.

you could arguably do this in perl/python (perl has an XML::IMDEF  
module, that might help), it'd just be kind of messy after having to  
hook into the bindings a bit...

fwiw.

On Dec 22, 2010, at 10:28 AM, Kaplan, Michael A wrote:

> I investigated a bit further and found that the IDMEF objects in the  
> PreludeCorrelator are ultimately passed through the function  
> SendIDMEF in main.py.  As I continued to trace this call, it looks  
> like the prelude c/c++ libraries receive this IDMEF object and  
> likely convert it to XML and send it to the prelude manager. I want  
> to send it to a location other than the prelude manager. Any ideas  
> on how I could do this? Is there a way to convert he IDMEF to XML in  
> the Correlator itself?

--
Wes
http://claimid.com/wesyoung


--Apple-Mail-7--952356031
content-type: application/pgp-signature; x-mac-type=70674453;
	name=PGP.sig
content-description: This is a digitally signed message part
content-disposition: inline; filename=PGP.sig
content-transfer-encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.10 (Darwin)

iEYEARECAAYFAk0SJcAACgkQKezpZd226UbrfACfUhheQ8lf3qp3+rJ7IlAByp1W
MSoAn2AU0ESu820hRd9u4fcnaEZGOXK7
=cuMM
-----END PGP SIGNATURE-----

--Apple-Mail-7--952356031--

--===============8839257046549583746==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-devel
--===============8839257046549583746==--