Re: R: How do you chain events within LML

Hi Justin,

So, you need to keep track of previous info for particular event (value b in 4th position in your case), 
right? Then rules should look like this:

regex=\w+ b \w+ (\w) \w+ \w \w+ \w \w+; \
id=2; \
new_context=_phase1_$1;expire:0; \
#some fields in idmef may be filled
silent;

regex=\w+ c \w+ (\w) \w+ \w \w+ \w \w+; \
id=3; \
require_context=_phase1_$1; \
new_context=_phase2_$1;expire:0; \
destroy_context=_phase1_$1; \
#some fields in idmef may be filled
silent;

regex=\w+ \w \w+ (\w) \w+ \w \w+ \w \w+; \
id=1; \
require_context=_phase2_$1; \
destroy_context=_phase2_$1; \
#required fields in idmef are filled
last;

Best regards,
Alexander Afonyashin

----- Original Message -----
From: [email protected]
To: [email protected]
Subject: [prelude-user] R: How do you chain events within LML
Date: Tue, 30 Jun 2009 13:40:48 -0600


I would like to create a generic filter that can be refined depending on a
value. Is the following the best way to achieve this or is there another
way?

Initial message

xxxxxxxx a xxxxxxxx b xxxxxxxx b xxxxxxxx b xxxxxxxx
xxxxxxxx c xxxxxxxx b xxxxxxxx b xxxxxxxx b xxxxxxxx
xxxxxxxx b xxxxxxxx b xxxxxxxx b xxxxxxxx b xxxxxxxx

regex=\w+ b \w+ \w \w+ \w \w+ \w \w+; \
id=2; \
chained; \
silent;

regex=\w+ c \w+ \w \w+ \w \w+ \w \w+; \
id=3; \
chained; \
silent;

regex=\w+ \w \w+ \w \w+ \w \w+ \w \w+; \
optgoto=2; \
optgoto=3; \
id=1; \




-------------------------------------------------------------------
Justin Buhler, CISSP
Information Security Specialist

[skipped]

-- 
Be Yourself @ mail.com!
Choose From 200+ Email Addresses
Get a Free Account at www.mail.com

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user