Re: Prelude-lml as a secure syslog

Take look at the "Reverse relaying" section:
https://trac.prelude-ids.org/wiki/PreludeManager
https://trac.prelude-ids.org/wiki/PreludesArchitecture

The basic idea is that you keep one (or N) Prelude Manager inside the DMZ
which collects data from other sources inside DMZ (like syslogs, probes,
local files etc.) and then it gets pooled by outsite (of DMZ) manager.


On 2/4/08, Manassypov, Igor <[email protected]> wrote:
>
> Hi all,
>
>
> I have a question pertaining to using prelude-lml package as a secure
> syslog replacement in dmz areas. Is it possible to configure it in such
> a way that it would securely relay syslog messages through a firewall to
> a centralized prelude manager, dumped to a file which then will be
> analyzed by the lml locally. I realize that I could analyze the events
> right there on the first sensor, however I would like to keep a filed
> copy of the events internally.
>
>
> Thanks!
>
>
> -igor
>
>
> Igor Manassypov, P.Eng., M.Eng.,
> Network Architect
> CI Investments Inc.
> 151 Yonge Street
> Toronto, ON M5C 2W7
> Tel:      (416) 364-1145 ext. 6311
> Direct:  (416) 681-7209
> Cell:     (416) 795-3147
>
>
>
> ###################################################################################
> This communication is confidential and may be
> privileged.  If you received it in error, please destroy
> without copying and advise the sender.
>
> By submitting personal information to CI Investments,
> you agree to the collection, use and disclosure of
> such personal information for the purposes described
> in our Privacy Policy available at www.ci.com.
>
>
> Cette communication est confidentielle et pourrait être
> privilégiée. Si vous la recevez par erreur, veuillez
> l'éliminer sans en faire une copie et aviser l'expéditeur.
>
> Lorsque vous soumettez des renseignements
> personnels à Placements CI, vous nous permettez de
> conserver, utiliser et divulguer ces renseignements
> personnels aux fins décrites dans nos Principes
> directeurs en matière de protection des renseignements personnels
> qui sont disponibles au www.ci.com.
>
> ################################################################
>
> _______________________________________________
> Prelude-user site list
> [email protected]
> http://www.prelude-ids.org/mailman/listinfo/prelude-user
>
_______________________________________________
Prelude-user site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-user