filtering and thresholding

Hi,

I am quite new to prelude-ids. It is not very clear on how the filtering and the thresholding definitions are applied. I am running Prelude Manager 0.9.14.2. Can someone confirm the following:

    * Only one rule is used per "idmef-criteria" filter definition. If
      you specify multiple rules then only the last one actually gets
      used e.g.

        [thresholding=test_thresh]
        path = alert.classification.text,
        alert.source.node.address.address
        limit = 3600
        count = 2
        hook = db

        [idmef-criteria=test]
        rule = alert.source.node.address.address == 1.1.1.1
        rule = alert.source.node.address.address == 2.2.2.2
        hook = thresholding[test_thresh]

        Only 2.2.2.2 is matched and thresholded i.e. the rules are not
        "OR'ed" together

    * A match on a filter is non-terminating -- other filters are
      attempted to be matched against e.g

        [thresholding=test_thresh]
        path = alert.classification.text,
        alert.source.node.address.address
        limit = 3600
        count = 2
        hook = db

        [idmef-criteria=test]
        rule = alert.source.node.address.address == 2.2.2.2
        hook = thresholding[test_thresh]

        [idmef-criteria=test1]
        rule = alert.classification.text == '(ftp_telnet) FTP command
        parameters were malformed'
        hook = db

        Traffic from 2.2.2.2 matching the signature '(ftp_telnet) FTP
        command parameters were malformed' appears to match on test1
        filter. If I do not define the test1 filter then any traffic
        from 2.2.2.2 is thresholded properly. However, then no other
        signatures show up on the Prewikka interface.


    Is there a way to do filtering-thresholding such that rest of the
    alerts that do not match the defined filter get logged to the
    database? Also is it possible to define a filter that is
    terminating - so that the same alert is not attempted to be
    matched against the other filters that are defined?

I guess I expected the filters to work like access-lists or iptables firewall rules matching from the top to bottom and terminating on the first match - can that be done?

Cheers
Vanish

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user