Re: How to Print Alert in XML Format

Thanks for the suggestion. I ended up writing a perl code to take arguments passed to it from PreludeCorrelator. This way I can build the XML in perl and then send it to my target destination from perl.



-----Original Message-----
From: Wes Young [mailto:[email protected]] 
Sent: Wednesday, December 22, 2010 11:22 AM
To: Kaplan, Michael A
Cc: [email protected]
Subject: Re: [prelude-devel] How to Print Alert in XML Format

iirc:

they serialize the idmef object within the c-lib (binary object, not
xml) and then xfer that to the manager (much faster). It's never really xml cause the idmef objects are all manipulated in memory.

I think they provide the binary-blob <--> xml converter as part of their commercial offering though.

a neat feature might be to re-write the libprelude using google protocol buffers, making it easier to deal with this sort of thing...  
right now, you'd need to write your own c-implementation of IDMEF that prints out the XML, depending on where you want the XML to pop out from. Not terribly hard to do if you have some time on your hands...  
With this, you could also leverage other messaging standards such as IODEF, ICSG, NMSG, and start making your managers more intelligent with other types of data (threat rep feeds, malware repo's, etc). For that you'd need to start overhauling the libpreludedb code too though to warehouse the raw messages (rather than just the overnormalized idmef stuff)... but that's a different thread for a different day.

you could arguably do this in perl/python (perl has an XML::IMDEF module, that might help), it'd just be kind of messy after having to hook into the bindings a bit...

fwiw.

On Dec 22, 2010, at 10:28 AM, Kaplan, Michael A wrote:

> I investigated a bit further and found that the IDMEF objects in the 
> PreludeCorrelator are ultimately passed through the function SendIDMEF 
> in main.py.  As I continued to trace this call, it looks like the 
> prelude c/c++ libraries receive this IDMEF object and likely convert 
> it to XML and send it to the prelude manager. I want to send it to a 
> location other than the prelude manager. Any ideas on how I could do 
> this? Is there a way to convert he IDMEF to XML in the Correlator 
> itself?

--
Wes
http://claimid.com/wesyoung

_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-devel