Reverse Relaying with filter

Hi,

I've tried to make the following architecture:

* Computer A: PC located in DMZ with a web server, prelude-lml,
prelude-correlator and prelude-manager1

* Computer B: PC located in internal LAN with prelude-manager2 and prewikka

The target is:

1.prelude-lml sends events to prelude manager1 (PC A), that sends events to
prelude-correlator.
2.prelude-correlator create correlated event and sends it to
prelude-manager1 (PC A).
3.prelude-manager2 (PC B) pull only correlated events from prelude-manager1
(PC A).

I was not able to achieve this architecture with a IDMEF Criteria on
reverse-relaying:

rule = alert.correlation_alert.name
hook = reverse-relaying

It doesn't have filtered the non-correlated events (and I've tried to put it
on both PC A and PC B).
It's not possible what I've tried to do? Why exist the reverse-relaying
hook?

Adding a prelude-manager3 to PC A (parent to the other manager1 on PC A and
with manager2 on PC B as child) I've been able to achieve the target. In
this new architecture I've put the IDMEF Criteria on the old manager1 :

rule = alert.correlation_alert.name
hook = relaying

Can someone explain me why the first version it's not possible to achieve?
For me it should be better with only one manager process on the PC A.

Thank you

-- 

Davide Belloni
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user