Re: Prelude-lml rule sets...

Adriel,

I had nothing to do with the changes, I can't write code to save my life.
This is all the result of the hardworking Prelude developers - and all the
credit goes to them.  I was merely pointing you in the direction of the
enhancements they had made, and answering the questions you had.

Scott

On Mon, Apr 28, 2008 at 8:07 PM, Adriel Desautels <[email protected]>
wrote:

> Scott,
>        My only other suggestion would be to set both the source and the
> target IP address to the agent's IP address IF one of the source or target
> is null. That would be particularly useful for file-system integrity change
> correlation events.
>
>        By the way, the changes that you've implemented... rock. Nice work!
>
> Regards,
>        Adriel T. Desautels
>        Chief Technology Officer
>        Netragard, LLC.
>        Office : 617-934-0269
>        Mobile : 617-633-3821
>        http://www.linkedin.com/pub/1/118/a45
>
>        Join the Netragard, LLC. Linked In Group:
>        http://www.linkedin.com/e/gis/48683/0B98E1705142
>
> ---------------------------------------------------------------
> Netragard, LLC - http://www.netragard.com  -  "We make IT Safe"
> Penetration Testing, Vulnerability Assessments, Website Security
>
> Netragard Whitepaper Downloads:
> -------------------------------
> Choosing the right provider : http://tinyurl.com/2ahk3j
> Three Things you must know  : http://tinyurl.com/26pjsn
>
>
> ScottO wrote:
>
> > Simon,
> >
> > Do you have the required Twisted packages installed?
> >
> > As per the release notes:
> >
> >
> > - Implement Prewikka Asynchronous DNS resolution in alert view
> >  as well as message summary (require twisted.names and
> > twisted.internet),
> >  see the additional dns_max_delay settings parameters in prewikka.conf.
> >
> >
> > On Mon, Apr 28, 2008 at 3:28 PM, Simon Smith <[email protected]> wrote:
> >
> >  ScotO,
> > >       I've upgraded my preqikka but it does not seem to be resolving
> > > IP
> > > addresses. Is there any documentation on this? Am I missing something
> > > specific that is required for proper functionality?
> > >
> > > ScottO wrote:
> > >
> > >  There already is in Prewikka.  Have a look at the second bullet down
> > > > in
> > > > http://prelude-ids.org/download/releases/prewikka-0.9.14.txt.
> > > >
> > > > scotto
> > > >
> > > > On Thu, Apr 24, 2008 at 5:11 PM, Simon Smith <[email protected]<mailto:
> > > > [email protected]>> wrote:
> > > >
> > > >   Greetings,
> > > >          Will there ever be a function in prelude that performs
> > > >   lookups on IP
> > > >   addresses, or at least allows a user to apply a name to an IP? Is
> > > > there
> > > >   one that I am missing already?
> > > >
> > > >
> > > >   --
> > > >
> > > >   - simon
> > > >
> > > >   ----------------------
> > > >   http://www.snosoft.com
> > > >
> > > >   _______________________________________________
> > > >   Prelude-user site list
> > > >   [email protected] <mailto:[email protected]>
> > > >   http://lists.prelude-ids.org/mailman/listinfo/prelude-user
> > > >
> > > >
> > > >
> > > >  --
> > >
> > > - simon
> > >
> > > ----------------------
> > > http://www.snosoft.com
> > >
> > >
> > >  _______________________________________________
> > Prelude-user site list
> > [email protected]
> > http://lists.prelude-ids.org/mailman/listinfo/prelude-user
> >
>
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user