Re: Whitelist certain hits in prelude-lml

Date: Mon, 5 Jan 2009 10:56:09 -1000
From: [email protected]
Subject: [prelude-user] Whitelist certain hits in prelude-lml
To: [email protected]
Message-ID:
 <OFE06ABB60.4C86DCAE-ON0A257535.0072F759-0A257535.007303C7@thdfsg.com>
Content-Type: text/plain; charset="US-ASCII"

I have a custom rule that I'm trying to write for prelude-lml.  I have the 

regex 
working, but there is a particular false-positive that I'd like to screen 
out. 

How would I set things up so that there wouldn't be a trigger if the 
target IP is 10.0.0.5?

How about if part of the regex matches a certain string? (IE, skip if $4 = 

"False Alarm")

To answer my own question:  In the relevant ruleset, place an "emtpy" 
match above 
the one being triggered with a more specific regex.

For example, suppose you have a firewall type rule that matches "Alarm" 
and captures
the source ip, destination ip and desitination port, but you want to skip 
it if the
source IP is 10.10.10.10 and destination port is 1001

#### Trigger on "Alarm: "
#### Unless it's on port 1001 from source IP 10.10.10.10
regex=Alarm: .*, src: 10.10.10.10, ([\d\.]+), proto: tcp, port: 1001; \
 last

regex=Alarm: (.*), src: ([\d\.]+), ([\d\.]+), proto: tcp, port: (\d+); \
  id = 9999; \
  revision= 9; \
  analyzer(0).name = foobar
  analyzer(0).class = something
  assessment.impact.type = whatever
  ...
  rest.of.the.stuff.goes = here 
  ...
 last





Dean Takemori
Tech Support Supervisor
TD Food Group
[email protected]
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user