Re: suppress message with idmef-criteria-filter

Assuming you don't want to suppress them going to the database as well, you
could apply a filter in Prewikka.

Go to Settings -> Filters.

Add a new one, with you're scenario you most likely want (if the alarm text
is in this field) : classification.text != "whatever your text is"

Put in Formula:  A

Give it a name and save it.

Then back on the Events tab, on the left hand-side, select the Filter
drop-down, and select your filter.  Hit Apply and it will apply it to your
current view, hit Save and it will save it as the default for your view as
well.

Hope that helps,

Scott

On Tue, Nov 11, 2008 at 8:09 AM, Varejante Solphins <[email protected]>wrote:

> Hello,
>
> As documentation says, it's possible to suppress alarms to be logged into
> prelude system.
> My question is:
> What is the best way to suppress a specific alarm (with a specific string)
> to not be show on prewikka (web interface).
>
> The documentation show a example that can help, but it isn't exact what I
> want:
>
> prelude-manager.conf
> ------------------------------------------------
> [TextMod]
>
> logfile = /var/log/prelude.log
> ------------------------------------------------
> [thresholding=sudotest]
> path = alert.classification.text, alert.target(0).node.address(0).address
> threshold = 1
> seconds = 3600
> limit= 3600
> hook = TextMod
> ------------------------------------------------
> [idmef-criteria-filter=sudotest]
> rule = alert.classification.text =~ 'Test Alarm'
> hook = thresholding[sudotest]
> ------------------------------------------------
>
> Any suggestions ?
> _______________________________________________
> Prelude-user site list
> [email protected]
> http://lists.prelude-ids.org/mailman/listinfo/prelude-user
>
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user