Re: Whitelist certain hits in prelude-lml

Hi,

Le lundi 05 janvier 2009 à 10:56 -1000, [email protected] a écrit :
> I have a custom rule that I'm trying to write for prelude-lml.  I have the 
> regex 
> working, but there is a particular false-positive that I'd like to screen 
> out. 
> 
> How would I set things up so that there wouldn't be a trigger if the 
> target IP is 10.0.0.5?
> 
> How about if part of the regex matches a certain string? (IE, skip if $4 = 
> "False Alarm")

In order to ignore specific log entry, you can use the "silent" keyword:
regex=your_regex; silent; last;

This instruct LML to remain silent, and stop matching other rules if
"your_regex" match.

Regards,

-- 
Yoann Vandoorselaere <[email protected]>
PreludeIDS Technologies

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user