Re: Correlation rules

Hi,

Le mardi 09 juin 2009 à 13:20 +0200, J. Ignacio Ormeño a écrit :
> I've been testing this new version and I'd like to share with you the
> following comments:
> 
> 1.- It's possible to implement Singleton pattern in Context class? I
> think could be usefull (less code on rules) so when you set a new
> context (scan.py rule for example), current version creates a new ctx
> object for each iteration of the loop, regardless of whether the
> object previously existed or not.
> 
> I've modified scan.py as following in order to have a scan rule
> working:
> 
>                 ctx = context.search("SCAN_EVENTSCAN_" + saddr +
> daddr)
>                 if not ctx:
>                     ctx = context.Context("SCAN_EVENTSCAN_" + saddr +
> daddr, { "expire": 100, "threshold": 5 }, update = True)

What you describe above is what the current repository code do (so long
as you use the 'update = True' parameter):

ctx = Context("MY_CTX", update=True)

This will create the MY_CTX context if it does not exist. Otherwise, the
existing context will be returned.


> 2.- I needed to make a change in rule bussines-hour.py to work
> properly:
> 
>      # Alert only on saturday and sunday, and everyday from 6:00pm to
> 9:00am.
>      if not (t.tm_wday == 5 or t.tm_wday == 6 or t.tm_hour <= 9 or
> t.tm_hour >= 18)
>          return;

Good catch, it should read:

if not (t.tm_wday == 5 or t.tm_wday == 6 or t.tm_hour < 9 or t.tm_hour > 17):

-- 
Yoann Vandoorselaere <[email protected]>
PreludeIDS Technologies

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user