Filtering in prelude-manager
"Konrad Kosmowski" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
How do I filter out alerts based on IDMEF criteria? For example I don't want to store in the database alerts which serverity is "low". I know how to define IDMEF criteria. I just don't know how to make prelude-manager to drop such alerts? Ideal for me would be logging of "high" and "medium" alerts to the database and "low" alerts to logfile which will then be rotated (via logrotate). How to do that? _______________________________________________ Prelude-user site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-user