Re: hook [smtp] and idmef-criteria-filter

SMTP wasn't included as open source until manager v0.9.13 i believe.

On Tue, Nov 4, 2008 at 7:09 AM, Varejante Solphins <[email protected]>wrote:

> Hello,
>
> I'm running prelude-manager 0.9.10.
>
>
> Thanks
>
> On Mon, Nov 3, 2008 at 3:29 PM, ScottO <[email protected]> wrote:
> > Which version of manager are you running?
> >
> > On Mon, Nov 3, 2008 at 12:17 PM, Varejante Solphins <[email protected]
> >
> > wrote:
> >>
> >> Hello,
> >>
> >> I'm trying to test the example posted in the wiki bellow in [1]. And
> >> the [smtp] module isn't instantiated [2]. When  I try to forward
> >> (hook) to another module, TextMod for example, the filter doesn't
> >> suppress or limit the number of messages.
> >>
> >> Any suggestions ?
> >>
> >>
> >> [1]
> >> Filter configuration
> >>
> >> [smtp]
> >> sender = [email protected]
> >> recipients = [email protected]
> >> smtp-server = mailserver.mycompanyname.com
> >>
> >> [thresholding=sudotest]
> >> path = alert.classification.text,
> alert.target(0).node.address(0).address
> >> threshold = 1
> >> seconds = 3600
> >> hook = smtp[default]
> >>
> >> [idmef-criteria-filter=sudotest]
> >> rule = alert.classification.text == 'SUDO Command Executed'
> >> hook = thresholding[sudotest]
> >>
> >> [2]
> >>
> >> INFO: Subscribing db[default] to active reporting plugins.
> >> INFO: Subscribing TextMod[default] to active reporting plugins.
> >>
> >>
> >> Thanks
> >> _______________________________________________
> >> Prelude-user site list
> >> [email protected]
> >> http://lists.prelude-ids.org/mailman/listinfo/prelude-user
> >
> >
>
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user