Re: Bro-IDS
Sebastien Tricaud <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
On Fri, May 30, 2008 at 02:49:48PM -0400, Adriel Desautels wrote: > Greetings, Hello Adriel, > I thought that bro-ids was supported by prelude? If so, how do I patch > bro for prelude support? It seem that according to http://www.prelude-ids.org/spip.php?rubrique24, Bro IDS is on the software matrix. However I cannot find code, and I guess that is there was code back in 2003 it may have to be updated. If you want to start developing Bro IDS as a prelude sensor, that would be awesome. There are two way to do so : - Natively: you must find the entry point in the code for alert management. Once you've find that, you will have to understand the program datastructure to import it as IDMEF. That will make Bro IDS a sensor such as Snort, Prelude LML, OSSEC, ... - Using Prelude LML: if the program logs its alerts, you add the log fine into the LML configuration or do nothing if it syslogs and have a look at pcre plugins to write your own ruleset handling Bro IDS alert format. I would recommend you doing the first. Using the high level IDMEF API and looking at Ossec code in analysis/prelude.c to see how it may looks like. Hope this helps, Sebastien. _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-user