Re: Undefinied alert defnitions
"Manassypov, Igor" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
Hey Steve, Thanks for the suggestion, sounds very interesting and it might be just what I am looking for. -igor -----Original Message----- From: Steve Grubb [mailto:[email protected]] Sent: Tuesday, February 05, 2008 11:16 AM To: [email protected] Cc: Sebastien Tricaud; Manassypov, Igor Subject: Re: [prelude-user] Undefinied alert defnitions On Tuesday 05 February 2008 11:08:48 Sebastien Tricaud wrote: > > That's what I thought, but on the other hand if I don't do that > > there is a risk of missing an event that I am not expecting. You can > > not really define a rule for every single alert that a particular > > device might throw at you. I was wondering if there'd be a way to > > generically classify unmatched alerts and submit them to the > > database, since an unclassified event is still an event... > > Prelude LML vocation is not to replace software like syslog-ng. But to > find specific patterns to create an IDMEF alert. > For database logging, I'd really advice you to go for syslog-ng. Or maybe give rsyslog a looking at. We've added gssapi support for trusted logging. It can use a SQL backend, it does realtime event classification via regex, and uses the familiar sysklogd configuration syntax. -Steve ################################################################################### This communication is confidential and may be privileged. If you received it in error, please destroy without copying and advise the sender. By submitting personal information to CI Investments, you agree to the collection, use and disclosure of such personal information for the purposes described in our Privacy Policy available at www.ci.com. Cette communication est confidentielle et pourrait être privilégiée. Si vous la recevez par erreur, veuillez l'éliminer sans en faire une copie et aviser l'expéditeur. Lorsque vous soumettez des renseignements personnels à Placements CI, vous nous permettez de conserver, utiliser et divulguer ces renseignements personnels aux fins décrites dans nos Principes directeurs en matière de protection des renseignements personnels qui sont disponibles au www.ci.com. ################################################################ _______________________________________________ Prelude-user site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-user