Re: Message Body Explanation

for a full understanding you could read the RFC that governs the payload 
format http://www.ietf.org/rfc/rfc4765.txt
also the prelude lml documentation has a mini cheat sheet that explains 
most of the fields.
here is section of  https://dev.prelude-ids.com/wiki/prelude/PreludeLml 
that is relevant to your question

    * *classification.text*: The name of the alert, from one of the
      origins listed below.
    * *classification.reference(x).origin*:The type of reference,
      permitted values are: unknown, vendor-specific, user-specific,
      bugtraqid, cve, osvdb
    * *classification.reference(x).name*: Exactly one string containing
      the name of the reference from the source.
    * *classification.reference(x).meaning*: A brief manager (or the
      human operator of the manager) description of the alert
    * *classification.reference(x).url*: A URL at which the manager (or
      the human operator of the manager) can find additional information
      about the alert. The document pointed to by the URL may include an
      in-depth description of the attack, appropriate countermeasures,
      or other information deemed relevant by the vendor.
    * *assessment.impact.severity*: An estimate of the relative severity
      of the event (Possible values are: /info/, /low/, /medium/, /high/).
    * *assessment.impact.completion*: An indication of whether the
      analyzer believes the attempt that the event describes was
      successful or not. The permitted values are: failed, succeeded.
    * *assessment.impact.type*: The type of attempt represented by this
      event, in relatively broad categories. The permitted values are:
      /admin/, /dos/, /file/, /recon/, /user/, /other/.
    * *assessment.impact.description*: May contain a textual description
      of the impact, if the analyzer is able to provide additional details.
    * *source(x).node.address(y).address*,
      *target(x).node.address(y).address*: Address that has been
      attacked/Address that issued the attack. There can be more than one.
    * *source(x).node.address(y).category*,
      *target(x).node.address(y).category*: The type of address
      provided. Possible values: /unknown/, /atm/, /e-mail/,
      /lotus-notes/, /mac/, /sna/, /vm/, /ipv4-addr/, /ipv4-addr-hex/,
      /ipv6-addr/, /ipv6-addr-hex/, /ipv6-net/, /ipv6-net-mask/.
    * source(x).node.address(y).vlan_name,
      target(x).node.address(y).vlan_name:The name of the Virtual LAN to
      which the address belongs.
    * *source(x).node.address(y).vlan_num*,
      *target(x).node.address(y).vlan_num*:The number of the Virtual LAN
      to which the address belongs.
    * *source(x).node.name*,*target(x).node.name*:The name of the
      equipment. This information MUST be provided if no Address
      information is given.
    * *source(x).node.category*,*target(x).node.category*:The domain
      from which the name information was obtained. Possible values are:
      /unknown/, /ads/, /afs/, /coda/, /dfs/, /dns/, /hosts/,
      /kerberos/, /nds/, /nis/, /nisplus/, /nt/, /wfw/.
    * *source(x).node.location*, *target().node.location*:The location
      of the equipment.
    * *source(x).spoofed*, *target(x).decoy*:An indication of whether
      the source/target is a decoy. The permitted values are: /unknown/,
      /yes/, /no/.
    * *source(x).interface*, *target(x).interface*: May be used by a
      network-based analyzer with multiple interfaces to indicate which
      interfaces this source/target was seen on.
    * *source(x).service.name*,*target(y).service.name*: The name of the
      service. Whenever possible, the name from the IANA list of
      well-known ports SHOULD be used.
    * *source(x).service.port*, *target(x).service.port*: The port
      number being used.
    * *source(x).service.iana_protocol_name*,
      *target(x).service.ianal_protocol_name*: The protocol being used.
    * *source(x).service.portlist*, *target(x).service.portlist*:A list
      of port numbers being used.
    * *source(x).user.category*, *target(y).user.category*:The type of
      user represented (/unknown/, /application/, /os-device/).
    * *source(x).user.user_id(y).type*,
      *target(x).user.user_id(y).type*: The type of user information
      represented (/current-user/, /original-user/, /target-user/,
      /user-privs/, /current-group/, /group-privs/, /other-privs/).
    * *source(x).user.user_id(y).name*,
      *target(x).user.user_id(y).name*: A user or group name.
    * *source(x).user.user_id(y).number*,
      *target(x).user.user_id(y).number:* A user or group number.
    * *source(x).process.name*, *target(x).process.name*: A process name
    * *source(x).process.pid*, *target(x).process.pid*: A process PID.


 
R King wrote:
> I am looking for documentation on the format of what is contained in the message body of alerts sent via the SMTP plugin in Prelude and a way to decode the data listed at the end (I'm assuming this is the payload).
>
>
>
>       
> _______________________________________________
> Prelude-user site list
> [email protected]
> http://lists.prelude-ids.org/mailman/listinfo/prelude-user
>   

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user