Re: hook [smtp] and idmef-criteria-filter

Which version of manager are you running?

On Mon, Nov 3, 2008 at 12:17 PM, Varejante Solphins <[email protected]>wrote:

> Hello,
>
> I'm trying to test the example posted in the wiki bellow in [1]. And
> the [smtp] module isn't instantiated [2]. When  I try to forward
> (hook) to another module, TextMod for example, the filter doesn't
> suppress or limit the number of messages.
>
> Any suggestions ?
>
>
> [1]
> Filter configuration
>
> [smtp]
> sender = [email protected]
> recipients = [email protected]
> smtp-server = mailserver.mycompanyname.com
>
> [thresholding=sudotest]
> path = alert.classification.text, alert.target(0).node.address(0).address
> threshold = 1
> seconds = 3600
> hook = smtp[default]
>
> [idmef-criteria-filter=sudotest]
> rule = alert.classification.text == 'SUDO Command Executed'
> hook = thresholding[sudotest]
>
> [2]
>
> INFO: Subscribing db[default] to active reporting plugins.
> INFO: Subscribing TextMod[default] to active reporting plugins.
>
>
> Thanks
> _______________________________________________
> Prelude-user site list
> [email protected]
> http://lists.prelude-ids.org/mailman/listinfo/prelude-user
>
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user