Re: Undefinied alert defnitions
"Manassypov, Igor" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
Sebastien, I was also hoping to use the prelude-manager's feature of reverse-relaying alerts out of dmz area for all of the syslog messages. Do you know if it is possible? The idea was to securely pulling out syslogs to common repository internally... Thanks! -----Original Message----- From: Sebastien Tricaud [mailto:[email protected]] Sent: Tuesday, February 05, 2008 11:09 AM To: Manassypov, Igor; [email protected] Subject: Re: [prelude-user] Undefinied alert defnitions On Feb 5, 2008 5:04 PM, Manassypov, Igor <[email protected]> wrote: > That's what I thought, but on the other hand if I don't do that there > is a risk of missing an event that I am not expecting. You can not > really define a rule for every single alert that a particular device > might throw at you. I was wondering if there'd be a way to generically > classify unmatched alerts and submit them to the database, since an > unclassified event is still an event... > Prelude LML vocation is not to replace software like syslog-ng. But to find specific patterns to create an IDMEF alert. For database logging, I'd really advice you to go for syslog-ng. ################################################################################### This communication is confidential and may be privileged. If you received it in error, please destroy without copying and advise the sender. By submitting personal information to CI Investments, you agree to the collection, use and disclosure of such personal information for the purposes described in our Privacy Policy available at www.ci.com. Cette communication est confidentielle et pourrait être privilégiée. Si vous la recevez par erreur, veuillez l'éliminer sans en faire une copie et aviser l'expéditeur. Lorsque vous soumettez des renseignements personnels à Placements CI, vous nous permettez de conserver, utiliser et divulguer ces renseignements personnels aux fins décrites dans nos Principes directeurs en matière de protection des renseignements personnels qui sont disponibles au www.ci.com. ################################################################ _______________________________________________ Prelude-user site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-user