Re: Filtering in prelude-manager
Scott O <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
Konrad Kosmowski wrote: > How do I filter out alerts based on IDMEF criteria? For example I > don't want to store in the database alerts which serverity is "low". > > I know how to define IDMEF criteria. I just don't know how to make > prelude-manager to drop such alerts? > > Ideal for me would be logging of "high" and "medium" alerts to the > database and "low" alerts to logfile which will then be rotated (via > logrotate). > > How to do that? > _______________________________________________ > Prelude-user site list > [email protected] > http://www.prelude-ids.org/mailman/listinfo/prelude-user > > Have a look at the "Stacking Filtering Plugins Together" section of the handbook: https://trac.prelude-ids.org/wiki/PreludeManager _______________________________________________ Prelude-user site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-user