Re: Undefinied alert defnitions
"Sebastien Tricaud" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
On Feb 5, 2008 4:53 PM, Manassypov, Igor <[email protected]> wrote: > Hi, > Hello Igor, > > How does one normally deal with an event that is not defined in pcre > rules? It will get missed by the lml, and will never get reported, > right? What would be the most graceful way of defining a catch-all rule > to generate a generic alert to at least bring the event up on the gui > screen? > By simply defining a pcre catch all, such as '.*'. I just wouldn't do that :) _______________________________________________ Prelude-user site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-user