Re: hook [smtp] and idmef-criteria-filter
"Varejante Solphins" <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
Hello, I'm running prelude-manager 0.9.10. Thanks On Mon, Nov 3, 2008 at 3:29 PM, ScottO <[email protected]> wrote: > Which version of manager are you running? > > On Mon, Nov 3, 2008 at 12:17 PM, Varejante Solphins <[email protected]> > wrote: >> >> Hello, >> >> I'm trying to test the example posted in the wiki bellow in [1]. And >> the [smtp] module isn't instantiated [2]. When I try to forward >> (hook) to another module, TextMod for example, the filter doesn't >> suppress or limit the number of messages. >> >> Any suggestions ? >> >> >> [1] >> Filter configuration >> >> [smtp] >> sender = [email protected] >> recipients = [email protected] >> smtp-server = mailserver.mycompanyname.com >> >> [thresholding=sudotest] >> path = alert.classification.text, alert.target(0).node.address(0).address >> threshold = 1 >> seconds = 3600 >> hook = smtp[default] >> >> [idmef-criteria-filter=sudotest] >> rule = alert.classification.text == 'SUDO Command Executed' >> hook = thresholding[sudotest] >> >> [2] >> >> INFO: Subscribing db[default] to active reporting plugins. >> INFO: Subscribing TextMod[default] to active reporting plugins. >> >> >> Thanks >> _______________________________________________ >> Prelude-user site list >> [email protected] >> http://lists.prelude-ids.org/mailman/listinfo/prelude-user > > _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-user