Re: Undefinied alert defnitions
"Manassypov, Igor" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
That's what I thought, but on the other hand if I don't do that there is a risk of missing an event that I am not expecting. You can not really define a rule for every single alert that a particular device might throw at you. I was wondering if there'd be a way to generically classify unmatched alerts and submit them to the database, since an unclassified event is still an event... -----Original Message----- From: Sebastien Tricaud [mailto:[email protected]] Sent: Tuesday, February 05, 2008 10:59 AM To: Manassypov, Igor Cc: [email protected] Subject: Re: [prelude-user] Undefinied alert defnitions On Feb 5, 2008 4:53 PM, Manassypov, Igor <[email protected]> wrote: > Hi, > Hello Igor, > > How does one normally deal with an event that is not defined in pcre > rules? It will get missed by the lml, and will never get reported, > right? What would be the most graceful way of defining a catch-all > rule to generate a generic alert to at least bring the event up on the > gui screen? > By simply defining a pcre catch all, such as '.*'. I just wouldn't do that :) ################################################################################### This communication is confidential and may be privileged. If you received it in error, please destroy without copying and advise the sender. By submitting personal information to CI Investments, you agree to the collection, use and disclosure of such personal information for the purposes described in our Privacy Policy available at www.ci.com. Cette communication est confidentielle et pourrait être privilégiée. Si vous la recevez par erreur, veuillez l'éliminer sans en faire une copie et aviser l'expéditeur. Lorsque vous soumettez des renseignements personnels à Placements CI, vous nous permettez de conserver, utiliser et divulguer ces renseignements personnels aux fins décrites dans nos Principes directeurs en matière de protection des renseignements personnels qui sont disponibles au www.ci.com. ################################################################ _______________________________________________ Prelude-user site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-user