Re: problems with prelude-manager's idmef-criteria and thresholding

Hi Ryan,

Le mardi 31 mars 2009 à 16:46 -0600, Ryan Skorstad a écrit :
> I am attempting to configure filters on my incoming events by setting up 
> idmef-criteria and thresholding in prelude-manager.conf.
> 
> My system is a Fedora 10 x86_64 box running prelude-manager-0.9.14.2-1 
> rpms obtained from Fedora Koji.
> 
> Following the documentation here:
> 
> https://trac.prelude-ids.org/wiki/PreludeManager/FilteringPlugins

[...]

> 
> When I try to start prelude-manager, I get these errors:
> 
> /etc/prelude-manager/prelude-manager.conf:19: invalid option "seconds" 
> in "global" section.
> /etc/prelude-manager/prelude-manager.conf:20: invalid option "hook" in 
> "global" section.
> 
> Also, the documentation states that the syntax should be 
> '[idmef-criteria-filter=bittorrent]' but when I use that I get even more 
> errors like the ones above.  Switching back to '[idmef-criteria]' seems 
> to make it complain less.
> 
> What am I doing wrong?  Am I missing a section definition somewhere?

We are at fault here, that part of the documentation was outdated, and
reflected the old option name. I updated the documentation which is now
available on:

https://dev.prelude-ids.com/wiki/prelude/PreludeManagerFilteringPlugins


The new way to do what you are trying to achieve is:

[thresholding=bittorrent]
path = alert.classification.text, lert.target(0).node.address(0).address
threshold = 3600
count = 1
hook = db


Note that a threshold of 1 look incorrect, threshold usually is used to
express somethings like 'forward every tenth event in X seconds to the
given plugin', so what you are looking for is probably:

[thresholding=bittorrent]
path = alert.classification.text, lert.target(0).node.address(0).address
limit = 3600
count = 1
hook = db


Hope this help,

-- 
Yoann Vandoorselaere <[email protected]>

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user