Re: Bro-IDS support in Prelude?
Steve Grubb <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Organization | Red Hat |
| Message-ID | <[email protected]> |
On Friday 10 July 2009 09:08:29 am Robert Vineyard wrote: > Has anyone tried integrating a Bro-IDS sensor with Prelude? I have not been > able to find native support on either side, but it seems like it would be > possible either using the Prelude-LML to parse the Bro logs or to have Bro > call a script that would generate an event within Prelude. I'm not opposed > to writing the code myself, but I wanted to see if anyone was aware of an > existing project to bridge these two applications. We have been looking at adding libprelude linking to BroIDS so that it can send events directly. Currently its designed to link against what appears to be an old and unmaintained IDMEF library. We haven't completed the work yet, but we want to get that connection. -Steve _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-user