Re: Reverse Relaying with filter

Hi,

Le dimanche 15 février 2009 à 19:16 +0100, China a écrit :
> I've tried to make the following architecture:
> 
> * Computer A: PC located in DMZ with a web server, prelude-lml,
> prelude-correlator and prelude-manager1
> 
> * Computer B: PC located in internal LAN with prelude-manager2 and prewikka
> 
> The target is:
> 
> 1.prelude-lml sends events to prelude manager1 (PC A), that sends events to
> prelude-correlator.
> 2.prelude-correlator create correlated event and sends it to
> prelude-manager1 (PC A).
> 3.prelude-manager2 (PC B) pull only correlated events from prelude-manager1
> (PC A).
> 
> I was not able to achieve this architecture with a IDMEF Criteria on
> reverse-relaying:
> 
> rule = alert.correlation_alert.name
> hook = reverse-relaying
> 
> It doesn't have filtered the non-correlated events (and I've tried to put it
> on both PC A and PC B).
> It's not possible what I've tried to do? Why exist the reverse-relaying
> hook?

It should have filtered out non correlated alert, but it's not possible
since you are going to hit another problem anyway:

prelude-correlator also pull alert from Prelude-Manager, and is going to
be impacted by the reverse-relaying filter: using such a filter,
prelude-correlator wouldn't get any events anymore.

The solution would be to develop a finer grained reverse-relaying hook
that would allow you to plug to a predefined analyzerid:

hook = reverse-relaying[analyzerid]

This is not implemented at the moment, so do not hesitate to open a
feature request on https://dev.prelude-ids.com if you'd like to see that
implemented.


Regards,

-- 
Yoann Vandoorselaere <[email protected]>

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user