Re: How to Print Alert in XML Format

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--===============0782638326523413533==
Content-Type: multipart/signed; protocol="application/pgp-signature"; micalg=pgp-sha1; boundary="Apple-Mail-8--950064179"
Content-Transfer-Encoding: 7bit

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--Apple-Mail-8--950064179
Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes
Content-Transfer-Encoding: 7bit

be sure to publish your work, cpan.org is your friend ;-)

On Dec 22, 2010, at 11:46 AM, Kaplan, Michael A wrote:

> Thanks for the suggestion. I ended up writing a perl code to take  
> arguments passed to it from PreludeCorrelator. This way I can build  
> the XML in perl and then send it to my target destination from perl.
>
>
>
> -----Original Message-----
> From: Wes Young [mailto:[email protected]]
> Sent: Wednesday, December 22, 2010 11:22 AM
> To: Kaplan, Michael A
> Cc: [email protected]
> Subject: Re: [prelude-devel] How to Print Alert in XML Format
>
> iirc:
>
> they serialize the idmef object within the c-lib (binary object, not
> xml) and then xfer that to the manager (much faster). It's never  
> really xml cause the idmef objects are all manipulated in memory.
>
> I think they provide the binary-blob <--> xml converter as part of  
> their commercial offering though.
>
> a neat feature might be to re-write the libprelude using google  
> protocol buffers, making it easier to deal with this sort of thing...
> right now, you'd need to write your own c-implementation of IDMEF  
> that prints out the XML, depending on where you want the XML to pop  
> out from. Not terribly hard to do if you have some time on your  
> hands...
> With this, you could also leverage other messaging standards such as  
> IODEF, ICSG, NMSG, and start making your managers more intelligent  
> with other types of data (threat rep feeds, malware repo's, etc).  
> For that you'd need to start overhauling the libpreludedb code too  
> though to warehouse the raw messages (rather than just the  
> overnormalized idmef stuff)... but that's a different thread for a  
> different day.
>
> you could arguably do this in perl/python (perl has an XML::IMDEF  
> module, that might help), it'd just be kind of messy after having to  
> hook into the bindings a bit...
>
> fwiw.
>
> On Dec 22, 2010, at 10:28 AM, Kaplan, Michael A wrote:
>
>> I investigated a bit further and found that the IDMEF objects in the
>> PreludeCorrelator are ultimately passed through the function  
>> SendIDMEF
>> in main.py.  As I continued to trace this call, it looks like the
>> prelude c/c++ libraries receive this IDMEF object and likely convert
>> it to XML and send it to the prelude manager. I want to send it to a
>> location other than the prelude manager. Any ideas on how I could do
>> this? Is there a way to convert he IDMEF to XML in the Correlator
>> itself?
>
> --
> Wes
> http://claimid.com/wesyoung
>

--
Wes
http://claimid.com/wesyoung


--Apple-Mail-8--950064179
content-type: application/pgp-signature; x-mac-type=70674453;
	name=PGP.sig
content-description: This is a digitally signed message part
content-disposition: inline; filename=PGP.sig
content-transfer-encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.10 (Darwin)

iEYEARECAAYFAk0SLrQACgkQKezpZd226UZOFgCfVpU00Zu0QpxZbEkjNBQWwaRf
2UAAoJrhR0gcTPva1r9afi1OHhxUHI8H
=5NOe
-----END PGP SIGNATURE-----

--Apple-Mail-8--950064179--

--===============0782638326523413533==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-technologies.com/mailman/listinfo/prelude-devel
--===============0782638326523413533==--