Re: Undefinied alert defnitions
"Sebastien Tricaud" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
On Feb 5, 2008 5:04 PM, Manassypov, Igor <[email protected]> wrote: > That's what I thought, but on the other hand if I don't do that there is > a risk of missing an event that I am not expecting. You can not really > define a rule for every single alert that a particular device might > throw at you. I was wondering if there'd be a way to generically > classify unmatched alerts and submit them to the database, since an > unclassified event is still an event... > Prelude LML vocation is not to replace software like syslog-ng. But to find specific patterns to create an IDMEF alert. For database logging, I'd really advice you to go for syslog-ng. _______________________________________________ Prelude-user site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-user