Re: Bro-IDS

Sebastien Tricaud <[email protected]>
Newsgroups gmane.comp.security.ids.prelude.user
Message-ID <[email protected]>
On Fri, May 30, 2008 at 02:49:48PM -0400, Adriel Desautels wrote:
> Greetings,

Hello Adriel,

> 	I thought that bro-ids was supported by prelude? If so, how do I patch
> bro for prelude support?

It seem that according to
http://www.prelude-ids.org/spip.php?rubrique24, Bro IDS is on the
software matrix.

However I cannot find code, and I guess that is there was code back in
2003 it may have to be updated.

If you want to start developing Bro IDS as a prelude sensor, that would
be awesome.

There are two way to do so :
- Natively: you must find the entry point in the code for alert
  management. Once you've find that, you will have to understand the
  program datastructure to import it as IDMEF. That will make Bro IDS a
  sensor such as Snort, Prelude LML, OSSEC, ...
- Using Prelude LML: if the program logs its alerts, you add the log
  fine into the LML configuration or do nothing if it syslogs and have a
  look at pcre plugins to write your own ruleset handling Bro IDS alert
  format.

I would recommend you doing the first. Using the high level IDMEF API
and looking at Ossec code in analysis/prelude.c to see how it may looks
like.


Hope this helps,
Sebastien.

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.