Re: Correlation rules

Hello Yoann,

Thank's for your reply.

I've been testing this new version and I'd like to share with you the
following comments:

1.- It's possible to implement Singleton pattern in Context class? I think
could be usefull (less code on rules) so when you set a new context (scan.py
rule for example), current version creates a new ctx object for each
iteration of the loop, regardless of whether the object previously existed
or not.

I've modified scan.py as following in order to have a scan rule working:

                ctx = context.search("SCAN_EVENTSCAN_" + saddr + daddr)
                if not ctx:
                    ctx = context.Context("SCAN_EVENTSCAN_" + saddr + daddr,
{ "expire": 100, "threshold": 5 }, update = True)

2.- I needed to make a change in rule bussines-hour.py to work properly:

     # Alert only on saturday and sunday, and everyday from 6:00pm to
9:00am.
     if not (t.tm_wday == 5 or t.tm_wday == 6 or t.tm_hour <= 9 or
t.tm_hour >= 18)
         return;

Kind regards!

Nacho

On Mon, Jun 8, 2009 at 10:39 AM, Yoann Vandoorselaere <
[email protected]> wrote:

> Hello,
>
> Le lundi 08 juin 2009 à 10:16 +0200, J. Ignacio Ormeño a écrit :
> > I'm starting to work in deepth with Prelude-correlator capabilities and I
> am
> > trying to develop some correlation rules using LUA.
> >
> > The problem is the following, when I try to run prelude-correlator using
> a
> > custom rule:
> >
> > $cat my_rule.lua
>
> [...]
>
> As has been announced recently, Prelude-Correlator have been re-written
> to Python, so I'd suggest dropping Lua in favor of the new rules
> language.
>
> You can get the current Prelude-Correlator codebase using:
> git clone git://git.prelude-ids.com/prelude-correlator
>
> Regards,
>
> --
> Yoann Vandoorselaere <[email protected]>
> PreludeIDS Technologies
>
>
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user